Added characters that look like padlocks to URL unescaping blacklist.

content/browser/web_contents/web_drag_source_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "content/browser/web_contents/web_drag_source_mac.h"
 
 #include <sys/param.h>
 
 #include "base/bind.h"
 #include "base/files/file.h"
@@ skipping 155 matching lines @@
   // URL.
   } else if ([type isEqualToString:NSURLPboardType]) {
     DCHECK(dropData_->url.is_valid());
     NSURL* url = [NSURL URLWithString:SysUTF8ToNSString(dropData_->url.spec())];
     // If NSURL creation failed, check for a badly-escaped JavaScript URL.
     // Strip out any existing escapes and then re-escape uniformly.
     if (!url && dropData_->url.SchemeIs(url::kJavaScriptScheme)) {
       net::UnescapeRule::Type unescapeRules =
           net::UnescapeRule::SPACES |
           net::UnescapeRule::URL_SPECIAL_CHARS |
-          net::UnescapeRule::CONTROL_CHARS;
+          net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS;
       std::string unescapedUrlString =
           net::UnescapeURLComponent(dropData_->url.spec(), unescapeRules);
       std::string escapedUrlString =
           net::EscapeUrlEncodedData(unescapedUrlString, false);
       url = [NSURL URLWithString:SysUTF8ToNSString(escapedUrlString)];
     }
     [url writeToPasteboard:pboard];
   // URL title.
   } else if ([type isEqualToString:kNSURLTitlePboardType]) {
     [pboard setString:SysUTF16ToNSString(dropData_->url_title)
@@ skipping 270 matching lines @@
 - (NSImage*)dragImage {
   if (dragImage_)
     return dragImage_;
 
   // Default to returning a generic image.
   return content::GetContentClient()->GetNativeImageNamed(
       IDR_DEFAULT_FAVICON).ToNSImage();
 }
 
 @end  // @implementation WebDragSource (Private)