Request XSSI-escaped response for suggest.

Request XSSI-escaped response for suggest.

This will request the suggest response to be escaped to protect it
against XSSI vulnerability and allow us to get psuggest responses
without using an XSRF token. Until the corresponding GWS change goes in,
the response is not modified. XSSI-escaped response will be correctly
handled after https://codereview.chromium.org/45863006/ lands.

BUG=312473
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=232268

[Peter Kasting, 2013-10-29 22:29:10]

LGTM

https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines...
File chrome/browser/search_engines/prepopulated_engines.json (right):

https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines...
chrome/browser/search_engines/prepopulated_engines.json:29:
"kCurrentDataVersion": 66
You need to increment this number.

[Anuj, 2013-10-29 22:30:59]

https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines...
File chrome/browser/search_engines/prepopulated_engines.json (right):

https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines...
chrome/browser/search_engines/prepopulated_engines.json:490: "suggest_url":
"{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}",
&xssi is sufficient. No value (=t) required

[mariakhomenko, 2013-10-29 22:34:27]

On Tue, Oct 29, 2013 at 3:30 PM, <skanuj@chromium.org> wrote:

>
> https://codereview.chromium.**org/51603002/diff/1/chrome/**
>
browser/search_engines/**prepopulated_engines.json<https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines/prepopulated_engines.json>
> File chrome/browser/search_engines/**prepopulated_engines.json (right):
>
> https://codereview.chromium.**org/51603002/diff/1/chrome/**
>
browser/search_engines/**prepopulated_engines.json#**newcode490<https://codereview.chromium.org/51603002/diff/1/chrome/browser/search_engines/prepopulated_engines.json#newcode490>
> chrome/browser/search_engines/**prepopulated_engines.json:490:
>
> "suggest_url":
> "{google:baseSuggestURL}**search?{google:**searchFieldtrialParameter}**
> client={google:suggestClient}&**xssi=t&q={searchTerms}&{**
> google:cursorPosition}{google:**zeroPrefixUrl}{google:**
> pageClassification}sugkey={**google:suggestAPIKeyParameter}**",
>  &xssi is sufficient. No value (=t) required
>

When I try that on Gilbert's test server only =t one returns escaped
results. ...&xssi&... is not escaped.


>
>
https://codereview.chromium.**org/51603002/<https://codereview.chromium.org/5...
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[commit-bot: I haz the power, 2013-10-31 17:47:30]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mariakhomenko@chromium.org/51603002/2

[commit-bot: I haz the power, 2013-10-31 17:47:31]

Failed to apply patch for
chrome/browser/search_engines/prepopulated_engines.json:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file chrome/browser/search_engines/prepopulated_engines.json
  Hunk #2 FAILED at 487.
  1 out of 2 hunks FAILED -- saving rejects to file
chrome/browser/search_engines/prepopulated_engines.json.rej

Patch:       chrome/browser/search_engines/prepopulated_engines.json
Index: chrome/browser/search_engines/prepopulated_engines.json
diff --git a/chrome/browser/search_engines/prepopulated_engines.json
b/chrome/browser/search_engines/prepopulated_engines.json
index
d8d741e6e82fd09ce2ab41ac1cf0337928b31a4f..2a495846a8427402d935a6c9eec7e14bde33e18f
100644
--- a/chrome/browser/search_engines/prepopulated_engines.json
+++ b/chrome/browser/search_engines/prepopulated_engines.json
@@ -26,7 +26,7 @@
 
     // Increment this if you change the data in ways that mean users with
     // existing data should get a new version.
-    "kCurrentDataVersion": 66
+    "kCurrentDataVersion": 67
   },
 
   // The following engines are included in country lists and are added to the
@@ -487,7 +487,7 @@
       "keyword": "google.com",
       "favicon_url": "http://www.google.com/favicon.ico",
       "search_url":
"{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}",
-      "suggest_url":
"{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}",
+      "suggest_url":
"{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}",
       "instant_url":
"{google:baseURL}webhp?sourceid=chrome-instant&{google:RLZ}{google:instantEnabledParameter}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}",
       "image_url": "{google:baseURL}searchbyimage/upload",
       "new_tab_url":
"{google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}",

[commit-bot: I haz the power, 2013-10-31 18:24:53]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mariakhomenko@chromium.org/51603002/28...

[commit-bot: I haz the power, 2013-10-31 23:38:17]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mariakhomenko@chromium.org/51603002/28...

[commit-bot: I haz the power, 2013-11-01 01:42:28]

Change committed as 232268