UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Steps to reproduce the problem:
1. open http://t.mhz.pw/game/xss/xss.php?xss=%3Cobject%3E%3Cparam%20name=%27url%27%20value=%27http://www.sogo.com%27%3E%3C/param%3E%3C/object%3E
2. open this url, shouldn't show the content of "www.sogo.com"

What is the expected behavior?
shouldn't show the content of "www.sogo.com"

What went wrong?
bool HTMLParamElement::IsURLParameter(const String& name) {
  return DeprecatedEqualIgnoringCase(name, "data") ||
         DeprecatedEqualIgnoringCase(name, "movie") ||
         DeprecatedEqualIgnoringCase(name, "src");
}

"url" should be filted too, because the object will get url from "'data','movie','src','url'".

    // HTML5 says that an object resource's URL is specified by the object's
    // data attribute, not by a param element. However, for compatibility, allow
    // the resource's URL to be given by a param named "src", "movie", "code" or
    // "url" if we know that resource points to a plugin.
    if (url_.IsEmpty() && (DeprecatedEqualIgnoringCase(name, "src") ||
                           DeprecatedEqualIgnoringCase(name, "movie") ||
                           DeprecatedEqualIgnoringCase(name, "code") ||
                           DeprecatedEqualIgnoringCase(name, "url"))) {
      url_ = StripLeadingAndTrailingHTMLSpaces(p->Value());
    }

Did this work before? N/A 

Chrome version: 61.0.3163.100  Channel: n/a
OS Version: 61.0.3163.100
Flash Version: non