Properly EscapeForHTML potentially malicious input from X.509 certificates.

chrome/browser/ssl/ssl_error_info.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_error_info.h"
 
 #include "base/i18n/time_formatting.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/common/time_format.h"
 #include "content/public/browser/cert_store.h"
 #include "googleurl/src/gurl.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "net/base/cert_status_flags.h"
+#include "net/base/escape.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_info.h"
 #include "ui/base/l10n/l10n_util.h"
 
 SSLErrorInfo::SSLErrorInfo(const string16& title,
                            const string16& details,
                            const string16& short_description,
                            const std::vector<string16>& extra_info)
     : title_(title),
       details_(details),
@@ skipping 23 matching lines @@
       size_t i = 0;
       for (; i < dns_names.size(); ++i) {
         if (dns_names[i] == cert->subject().common_name)
           break;
       }
       if (i == dns_names.size())
         i = 0;
       details =
           l10n_util::GetStringFUTF16(IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS,
                                      UTF8ToUTF16(request_url.host()),
-                                     UTF8ToUTF16(dns_names[i]),
+                                     net::EscapeForHTML(
+                                         UTF8ToUTF16(dns_names[i])),
                                      UTF8ToUTF16(request_url.host()));
       short_description = l10n_util::GetStringUTF16(
           IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION);
       extra_info.push_back(
           l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1));
       extra_info.push_back(
           l10n_util::GetStringFUTF16(
               IDS_CERT_ERROR_COMMON_NAME_INVALID_EXTRA_INFO_2,
-              UTF8ToUTF16(cert->subject().common_name),
+              net::EscapeForHTML(UTF8ToUTF16(cert->subject().common_name)),
               UTF8ToUTF16(request_url.host())));
       break;
     }
     case CERT_DATE_INVALID:
       extra_info.push_back(
           l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1));
       if (cert->HasExpired()) {
         title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_TITLE);
         details = l10n_util::GetStringFUTF16(
             IDS_CERT_ERROR_EXPIRED_DETAILS,
@@ skipping 198 matching lines @@
         bool r = content::CertStore::GetInstance()->RetrieveCert(
             cert_id, &cert);
         DCHECK(r);
       }
       if (errors)
         errors->push_back(SSLErrorInfo::CreateError(kErrorTypes[i], cert, url));
     }
   }
   return count;
 }