Apply XSSAuditor to html5 import (i.e. <link rel="import">) tags.

Source/core/html/parser/XSSAuditor.cpp

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  * Copyright (C) 2011 Daniel Bates (dbates@intudata.com).
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 426 matching lines @@
     else if (hasName(request.token, metaTag))
         didBlockScript |= filterMetaToken(request);
     else if (hasName(request.token, baseTag))
         didBlockScript |= filterBaseToken(request);
     else if (hasName(request.token, formTag))
         didBlockScript |= filterFormToken(request);
     else if (hasName(request.token, inputTag))
         didBlockScript |= filterInputToken(request);
     else if (hasName(request.token, buttonTag))
         didBlockScript |= filterButtonToken(request);
+    else if (hasName(request.token, linkTag))
+        didBlockScript |= filterLinkToken(request);
 
     return didBlockScript;
 }
 
 void XSSAuditor::filterEndToken(const FilterTokenRequest& request)
 {
     ASSERT(m_scriptTagNestingLevel);
     m_state = FilteringTokens;
     if (hasName(request.token, scriptTag)) {
         m_scriptTagNestingLevel--;
@@ skipping 136 matching lines @@
 }
 
 bool XSSAuditor::filterButtonToken(const FilterTokenRequest& request)
 {
     ASSERT(request.token.type() == HTMLToken::StartTag);
     ASSERT(hasName(request.token, buttonTag));
 
     return eraseAttributeIfInjected(request, formactionAttr, kURLWithUniqueOrigin, SrcLikeAttributeTruncation);
 }
 
+bool XSSAuditor::filterLinkToken(const FilterTokenRequest& request)
+{
+    ASSERT(request.token.type() == HTMLToken::StartTag);
+    ASSERT(hasName(request.token, linkTag));
+
+    size_t indexOfAttribute = 0;
+    if (!findAttributeWithName(request.token, relAttr, indexOfAttribute))
+        return false;
+
+    const HTMLToken::Attribute& attribute = request.token.attributes().at(indexOfAttribute);
+    if (!equalIgnoringCase(String(attribute.value), "import"))
+        return false;
+
+    return eraseAttributeIfInjected(request, hrefAttr, kURLWithUniqueOrigin, SrcLikeAttributeTruncation, AllowSameOriginHref);
+}
+
 bool XSSAuditor::eraseDangerousAttributesIfInjected(const FilterTokenRequest& request)
 {
     DEFINE_STATIC_LOCAL(String, safeJavaScriptURL, ("javascript:void(0)"));
 
     bool didBlockScript = false;
     for (size_t i = 0; i < request.token.attributes().size(); ++i) {
         bool eraseAttribute = false;
         bool valueContainsJavaScriptURL = false;
         const HTMLToken::Attribute& attribute = request.token.attributes().at(i);
         // FIXME: Don't create a new String for every attribute.value in the document.
@@ skipping 13 matching lines @@
         if (!eraseAttribute)
             continue;
         request.token.eraseValueOfAttribute(i);
         if (valueContainsJavaScriptURL)
             request.token.appendToAttributeValue(i, safeJavaScriptURL);
         didBlockScript = true;
     }
     return didBlockScript;
 }
 
-bool XSSAuditor::eraseAttributeIfInjected(const FilterTokenRequest& request, const QualifiedName& attributeName, const String& replacementValue, TruncationKind treatment)
+bool XSSAuditor::eraseAttributeIfInjected(const FilterTokenRequest& request, const QualifiedName& attributeName, const String& replacementValue, TruncationKind treatment, HrefRestriction restriction)
 {
     size_t indexOfAttribute = 0;
     if (!findAttributeWithName(request.token, attributeName, indexOfAttribute))
         return false;
 
     const HTMLToken::Attribute& attribute = request.token.attributes().at(indexOfAttribute);
     if (!isContainedInRequest(canonicalize(snippetFromAttribute(request, attribute), treatment)))
         return false;
 
-    if (threadSafeMatch(attributeName, srcAttr)) {
+    if (threadSafeMatch(attributeName, srcAttr) || (restriction == AllowSameOriginHref && threadSafeMatch(attributeName, hrefAttr))) {
         if (isLikelySafeResource(String(attribute.value)))
             return false;
     } else if (threadSafeMatch(attributeName, http_equivAttr)) {
         if (!isDangerousHTTPEquiv(String(attribute.value)))
             return false;
     }
 
     request.token.eraseValueOfAttribute(indexOfAttribute);
     if (!replacementValue.isEmpty())
         request.token.appendToAttributeValue(indexOfAttribute, replacementValue);
@@ skipping 148 matching lines @@
 
 bool XSSAuditor::isSafeToSendToAnotherThread() const
 {
     return m_documentURL.isSafeToSendToAnotherThread()
         && m_decodedURL.isSafeToSendToAnotherThread()
         && m_decodedHTTPBody.isSafeToSendToAnotherThread()
         && m_httpBodyAsString.isSafeToSendToAnotherThread();
 }
 
 } // namespace blink