Escape javascript going into text notifications.

chrome/browser/notifications/desktop_notification_service.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/notifications/desktop_notification_service.h"
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/string_piece.h"
 #include "base/string_util.h"
@@ skipping 14 matching lines @@
 #include "chrome/browser/worker_host/worker_process_host.h"
 #include "chrome/common/child_process_host.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/pref_service.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
 #include "grit/browser_resources.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/theme_resources.h"
+#include "net/base/escape.h"
 #include "third_party/WebKit/WebKit/chromium/public/WebNotificationPresenter.h"
 
 using WebKit::WebNotificationPresenter;
 
 // Creates a data:xxxx URL which contains the full HTML for a notification
 // using supplied icon, title, and text, run through a template which contains
 // the standard formatting for notifications.
 static string16 CreateDataUrl(const GURL& icon_url, const string16& title,
     const string16& body) {
   const base::StringPiece template_html(
       ResourceBundle::GetSharedInstance().GetRawDataResource(
           IDR_NOTIFICATION_HTML));
 
   if (template_html.empty()) {
     NOTREACHED() << "unable to load template. ID: " << IDR_NOTIFICATION_HTML;
     return EmptyString16();
   }
 
   std::vector<string16> subst;
   if (icon_url.is_valid())
     subst.push_back(UTF8ToUTF16(icon_url.spec()));
   else
     subst.push_back(EmptyString16());
 
-  subst.push_back(title);
-  subst.push_back(body);
+  subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(title))));
+  subst.push_back(UTF8ToUTF16(EscapeForHTML(UTF16ToUTF8(body))));
 
   if (icon_url.is_valid()) {
     subst.push_back(ASCIIToUTF16("block"));
     subst.push_back(ASCIIToUTF16("60"));
   } else {
     subst.push_back(ASCIIToUTF16("none"));
     subst.push_back(ASCIIToUTF16("5"));
   }
 
   string16 format_string = ASCIIToUTF16("data:text/html;charset=utf-8,"
@@ skipping 254 matching lines @@
   if (origin.SchemeIs(chrome::kExtensionScheme)) {
     ExtensionsService* ext_service = profile_->GetExtensionsService();
     if (ext_service) {
       Extension* extension = ext_service->GetExtensionByURL(origin);
       if (extension)
         return ASCIIToWide(extension->name());
     }
   }
   return UTF8ToWide(origin.spec());
 }