From f5c301422b01373b89e8fc8dc55d983c499a22ef Mon Sep 17 00:00:00 2001
From: Jun Kokatsu <jkokatsu@google.com>
Date: Fri, 26 May 2023 19:27:22 -0700
Subject: [PATCH] Add a runtime enabled feature for Dangling Markup in target
 name

Implementation for https://github.com/whatwg/html/pull/9309.

Bug: 1421440
Change-Id: I704ecbc0f18e48c32966a77bae2307e96eb44073
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4553305
Commit-Queue: Jun Kokatsu <jkokatsu@google.com>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1150017}
---
 ...dangling-markup-window-name.tentative.html | 97 +++++++++++++++++++
 .../windows/resources/window-name.sub.html    |  2 +-
 2 files changed, 98 insertions(+), 1 deletion(-)
 create mode 100644 html/browsers/windows/dangling-markup-window-name.tentative.html
diff --git a/html/browsers/windows/dangling-markup-window-name.tentative.html b/html/browsers/windows/dangling-markup-window-name.tentative.html
new file mode 100644
index 00000000000000..1bc8bb9f7ff558
--- /dev/null
+++ b/html/browsers/windows/dangling-markup-window-name.tentative.html
@@ -0,0 +1,97 @@
+<!doctype html>
+<html>
+<head>
+  <title>Dangling Markup in target</title>
+  <meta name="timeout" content="long">
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/common/utils.js"></script>
+</head>
+<body>
+  <script>
+    function anchorClick(target, id) {
+      const hyperlink = document.body.appendChild(document.createElement('a'));
+      if (target) {
+        hyperlink.target = target;
+      }
+      hyperlink.href = `resources/window-name.sub.html?report=${id}|close`;
+      hyperlink.click();
+    }
+
+    async function pollResultAndCheck(t, id, expected) {
+      const stashURL = new URL('resources/window-name-stash.py', location);
+      stashURL.searchParams.set('id', id);
+
+      let res = 'NONE';
+      while (res == 'NONE') {
+        await new Promise(resolve => { t.step_timeout(resolve, 100); });
+
+        const response = await fetch(stashURL);
+        res = await response.text();
+      }
+      if (res !== expected) {
+        assert_unreached('Stash result does not equal expected result.')
+      }
+    }
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      window.open(`resources/window-name.sub.html?report=${id}|close`, value);
+      await pollResultAndCheck(t, id, value);
+    }, 'Dangling Markup in target is not reset when set by window.open');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\n" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\r<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\r" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\t<' + id;
+
+      anchorClick(value, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup with "\\t" in target is reset when set by <a> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+
+      const form = document.body.appendChild(document.createElement('form'));
+      form.target = value;
+      form.method = 'GET';
+      form.action = 'resources/window-name.sub.html';
+      const input = form.appendChild(document.createElement('input'));
+      input.type = 'hidden';
+      input.name = 'report';
+      input.value = `${id}|close`;
+      form.submit();
+
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup in target is reset when set by <form> tag');
+
+    promise_test(async t => {
+      const id = token();
+      const value = '\n<' + id;
+      const base = document.head.appendChild(document.createElement('base'));
+      base.target = value;
+
+      anchorClick(null, id)
+      await pollResultAndCheck(t, id, '');
+    }, 'Dangling Markup in target is reset when set by <base> tag');
+  </script>
+</body>
+</html>
diff --git a/html/browsers/windows/resources/window-name.sub.html b/html/browsers/windows/resources/window-name.sub.html
index 55fb8ebbbc5957..5bb8ebda8f8513 100644
--- a/html/browsers/windows/resources/window-name.sub.html
+++ b/html/browsers/windows/resources/window-name.sub.html
@@ -2,7 +2,7 @@
 <title>popup helper</title>
 <script>
 
-const search = window.location.search.replace("?", "");
+  const search = decodeURIComponent(window.location.search.replace("?", ""));
 const steps = search.split("|");
 
 async function proceedTest() {
