Code: void LinkChangeSerializerMarkupAccumulator::appendElement(StringBuilder& result, Element& element, Namespaces* namespaces)
{
    if (element.hasTagName(HTMLNames::htmlTag)) {
         result.append('\n');
        MarkupFormatter::appendComment(result, String::format(" saved from url=(%04d)%s ",
            static_cast<int>(document().url().string().utf8().length()),
            document().url().string().utf8().data()));
         result.append('\n');
     }
 
    if (element.hasTagName(HTMLNames::baseTag)) {
        result.appendLiteral("<base href=\".\"");
        if (!document().baseTarget().isEmpty()) {
            result.appendLiteral(" target=\"");
            MarkupFormatter::appendAttributeValue(result, document().baseTarget(), document().isHTMLDocument());
            result.append('"');
        }
        if (document().isXHTMLDocument())
            result.appendLiteral(" />");
        else
            result.appendLiteral(">");
    } else {
        SerializerMarkupAccumulator::appendElement(result, element, namespaces);
    }
}

Vulnerability Type: 
CWE ID: CWE-20
Summary: The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web (MOTW) comments for URLs containing a *--* sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring.
Commit Message: Escape "--" in the page URL at page serialization

This patch makes page serializer to escape the page URL embed into a HTML
comment of result HTML[1] to avoid inserting text as HTML from URL by
introducing a static member function |PageSerialzier::markOfTheWebDeclaration()|
for sharing it between |PageSerialzier| and |WebPageSerialzier| classes.

[1] We use following format for serialized HTML:
saved from url=(${lengthOfURL})${URL}

BUG=503217
TEST=webkit_unit_tests --gtest_filter=PageSerializerTest.markOfTheWebDeclaration
TEST=webkit_unit_tests --gtest_filter=WebPageSerializerTest.fromUrlWithMinusMinu

Review URL: https://codereview.chromium.org/1371323003

Cr-Commit-Position: refs/heads/master@{#351736}