Google Git
Sign in
chromium / chromium / src.git / 505af9fbb775e3ee7a7b2054983b1ddaa14b3b90
commit505af9fbb775e3ee7a7b2054983b1ddaa14b3b90[log] [tgz]
authorJun Kokatsu <[email protected]>Tue May 05 11:59:47 2020
committerCommit Bot <[email protected]>Tue May 05 11:59:47 2020
tree607f0baf2e48e266fcf887a2b84ce7b00bb1e903
parent873c14a3b9675cb23a09bcff96db75e1d1bc7a45 [diff]
Remove `innerHTML` usage in chrome://histograms

While Bug 1073409 fixed an XSS, a renderer process can still inject
`<a>` tag because it's whitelisted by default in parse_html_subset.js.
This patch entirely removes usage of innerHTML, thus removing this risk.

This change also fixes a potential XSS in chrome://histograms on iOS

Bug: 41905
Change-Id: Ibc1b04d02e9b1442e7c441b5494ea6161d26a6a8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2172698
Commit-Queue: Jun Kokatsu <[email protected]>
Auto-Submit: Jun Kokatsu <[email protected]>
Reviewed-by: Mike Dougherty <[email protected]>
Reviewed-by: Alexei Svitkine <[email protected]>
Reviewed-by: dpapad <[email protected]>
Reviewed-by: Avi Drissman <[email protected]>
Cr-Commit-Position: refs/heads/master@{#765491}
17 files changed
tree: 607f0baf2e48e266fcf887a2b84ce7b00bb1e903
  1. android_webview/
  2. apps/
  3. ash/
  4. base/
  5. build/
  6. build_overrides/
  7. buildtools/
  8. cc/
  9. chrome/
  10. chromecast/
  11. chromeos/
  12. cloud_print/
  13. components/
  14. content/
  15. courgette/
  16. crypto/
  17. dbus/
  18. device/
  19. docs/
  20. extensions/
  21. fuchsia/
  22. gin/
  23. google_apis/
  24. google_update/
  25. gpu/
  26. headless/
  27. infra/
  28. ios/
  29. ipc/
  30. jingle/
  31. media/
  32. mojo/
  33. native_client_sdk/
  34. net/
  35. pdf/
  36. ppapi/
  37. printing/
  38. remoting/
  39. rlz/
  40. sandbox/
  41. services/
  42. skia/
  43. sql/
  44. storage/
  45. styleguide/
  46. testing/
  47. third_party/
  48. tools/
  49. ui/
  50. url/
  51. weblayer/
  52. .clang-format
  53. .clang-tidy
  54. .eslintrc.js
  55. .git-blame-ignore-revs
  56. .gitattributes
  57. .gitignore
  58. .gn
  59. .vpython
  60. .vpython3
  61. .yapfignore
  62. AUTHORS
  63. BUILD.gn
  64. CODE_OF_CONDUCT.md
  65. codereview.settings
  66. DEPS
  67. ENG_REVIEW_OWNERS
  68. LICENSE
  69. LICENSE.chromium_os
  70. OWNERS
  71. PRESUBMIT.py
  72. PRESUBMIT_test.py
  73. PRESUBMIT_test_mocks.py
  74. README.md
  75. WATCHLISTS
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure .

For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.