Allow view-source of pages fully-blocked by Blink's XSS filter.

chrome/browser/ui/browser_commands.cc

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/browser_commands.h"
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 1130 matching lines @@
 
 void ViewSource(Browser* browser, WebContents* contents) {
   DCHECK(contents);
 
   // Use the last committed entry, since the pending entry hasn't loaded yet and
   // won't be copied into the cloned tab.
   NavigationEntry* entry = contents->GetController().GetLastCommittedEntry();
   if (!entry)
     return;
 
+  // The URL "data:," is a special case, since Blink uses it when it wants to
+  // show a "blocked page" from its reflected XSS filter. When the XSS filter
+  // triggers, the current entry gets marked as containing an XSS, and then a
+  // new navigation to "data:," occurs on top of it. Showing that page in place
+  // of the "data:," URL permits examination of the cause of the reflection.
+  if (entry->GetURL() == GURL("data:,")) {
+    NavigationEntry* previous = contents->GetController().GetEntryAtOffset(-1);
+    if (previous && previous->GetXssDetected())
+      entry = previous;
+  }
+
   ViewSource(browser, contents, entry->GetURL(), entry->GetPageState());
 }
 
 void ViewSource(Browser* browser,
                 WebContents* contents,
                 const GURL& url,
                 const content::PageState& page_state) {
   content::RecordAction(UserMetricsAction("ViewSource"));
   DCHECK(contents);
 
@@ skipping 105 matching lines @@
                                           browser->profile(),
                                           browser->host_desktop_type()));
   app_browser->tab_strip_model()->AppendWebContents(contents, true);
 
   contents->GetMutableRendererPrefs()->can_accept_load_drops = false;
   contents->GetRenderViewHost()->SyncRendererPrefs();
   app_browser->window()->Show();
 }
 
 }  // namespace chrome