Added characters that look like padlocks to URL unescaping blacklist.

net/base/escape.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_ESCAPE_H_
 #define NET_BASE_ESCAPE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 76 matching lines @@
 
     // Unescapes various characters that will change the meaning of URLs,
     // including '%', '+', '&', '/', '#'. If we unescaped these characters, the
     // resulting URL won't be the same as the source one. This flag is used when
     // generating final output like filenames for URLs where we won't be
     // interpreting as a URL and want to do as much unescaping as possible.
     URL_SPECIAL_CHARS = 4,
 
     // Unescapes control characters such as %01. This INCLUDES NULLs. This is
     // used for rare cases such as data: URL decoding where the result is binary
-    // data. This flag also unescapes BiDi control characters.
+    // data. This flag also unescapes BiDi control characters and spoofable
+    // characters (such as LOCK).
     //
     // DO NOT use CONTROL_CHARS if the URL is going to be displayed in the UI
     // for security reasons.
     CONTROL_CHARS = 8,
 
     // URL queries use "+" for space. This flag controls that replacement.
     REPLACE_PLUS_WITH_SPACE = 16,
   };
 };
 
@@ skipping 27 matching lines @@
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments);
 
 // Unescapes the following ampersand character codes from |text|:
 // &lt; &gt; &amp; &quot; &#39;
 NET_EXPORT base::string16 UnescapeForHTML(const base::string16& text);
 
 }  // namespace net
 
 #endif  // NET_BASE_ESCAPE_H_