Apply XSSAuditor to html5 import (i.e. <link rel="import">) tags.

Source/core/html/parser/XSSAuditor.h

 /*
  * Copyright (C) 2011 Adam Barth. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 64 matching lines @@
         SuppressingAdjacentCharacterTokens
     };
 
     enum TruncationKind {
         NoTruncation,
         NormalAttributeTruncation,
         SrcLikeAttributeTruncation,
         ScriptLikeAttributeTruncation
     };
 
+    enum HrefRestriction {
+        ProhibitSameOriginHref,
+        AllowSameOriginHref
+    };
+
     bool filterStartToken(const FilterTokenRequest&);
     void filterEndToken(const FilterTokenRequest&);
     bool filterCharacterToken(const FilterTokenRequest&);
     bool filterScriptToken(const FilterTokenRequest&);
     bool filterObjectToken(const FilterTokenRequest&);
     bool filterParamToken(const FilterTokenRequest&);
     bool filterEmbedToken(const FilterTokenRequest&);
     bool filterAppletToken(const FilterTokenRequest&);
     bool filterFrameToken(const FilterTokenRequest&);
     bool filterMetaToken(const FilterTokenRequest&);
     bool filterBaseToken(const FilterTokenRequest&);
     bool filterFormToken(const FilterTokenRequest&);
     bool filterInputToken(const FilterTokenRequest&);
     bool filterButtonToken(const FilterTokenRequest&);
+    bool filterLinkToken(const FilterTokenRequest&);
 
     bool eraseDangerousAttributesIfInjected(const FilterTokenRequest&);
-    bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName&, const String& replacementValue = String(), TruncationKind treatment = NormalAttributeTruncation);
+    bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName&, const String& replacementValue = String(), TruncationKind treatment = NormalAttributeTruncation, HrefRestriction = ProhibitSameOriginHref);

[Tom Sepez, 2014/10/09 19:31:02]

nit: the existing name "treatment" here adds no value. Maybe remove it before
checking this in.

 
     String canonicalizedSnippetForTagName(const FilterTokenRequest&);
     String canonicalizedSnippetForJavaScript(const FilterTokenRequest&);
     String nameFromAttribute(const FilterTokenRequest&, const HTMLToken::Attribute&);
     String snippetFromAttribute(const FilterTokenRequest&, const HTMLToken::Attribute&);
     String canonicalize(String, TruncationKind);
 
     bool isContainedInRequest(const String&);
     bool isLikelySafeResource(const String& url);
 
@@ skipping 11 matching lines @@
 
     State m_state;
     bool m_scriptTagFoundInRequest;
     unsigned m_scriptTagNestingLevel;
     WTF::TextEncoding m_encoding;
 };
 
 }
 
 #endif