Added characters that look like padlocks to URL unescaping blacklist.

extensions/browser/api/web_request/form_data_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/web_request/form_data_parser.h"
 
 #include <vector>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ skipping 332 matching lines @@
     case ERROR_CHOICE:
       return scoped_ptr<FormDataParser>();
   }
   NOTREACHED();  // Some compilers do not believe this is unreachable.
   return scoped_ptr<FormDataParser>();
 }
 
 FormDataParser::FormDataParser() {}
 
 const net::UnescapeRule::Type FormDataParserUrlEncoded::unescape_rules_ =
-    net::UnescapeRule::URL_SPECIAL_CHARS | net::UnescapeRule::CONTROL_CHARS |
-    net::UnescapeRule::SPACES | net::UnescapeRule::REPLACE_PLUS_WITH_SPACE;
+    net::UnescapeRule::URL_SPECIAL_CHARS |
+    net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS | net::UnescapeRule::SPACES |
+    net::UnescapeRule::REPLACE_PLUS_WITH_SPACE;
 
 FormDataParserUrlEncoded::FormDataParserUrlEncoded()
     : source_(NULL),
       source_set_(false),
       source_malformed_(false),
       arg_name_(&name_),
       arg_value_(&value_),
       patterns_(g_patterns.Pointer()) {
   args_[0] = &arg_name_;
   args_[1] = &arg_value_;
@@ skipping 144 matching lines @@
   // dash-boundary.
   bool return_value;
   if (value_assigned && source_.empty()) {  // Wait for a new source?
     return_value = true;
     state_ = STATE_SUSPEND;
   } else {
     return_value = FinishReadingPart(value_assigned ? NULL : &value);
   }
 
   std::string unescaped_name = net::UnescapeURLComponent(
-      name.as_string(),
-      net::UnescapeRule::URL_SPECIAL_CHARS | net::UnescapeRule::CONTROL_CHARS);
+      name.as_string(), net::UnescapeRule::URL_SPECIAL_CHARS |
+                            net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS);
   result->set_name(unescaped_name);
   result->set_value(value);
 
   return return_value;
 }
 
 bool FormDataParserMultipart::SetSource(base::StringPiece source) {
   if (source.data() == NULL || !source_.empty())
     return false;
   source_.set(source.data(), source.size());
@@ skipping 55 matching lines @@
   if (value_pattern().Match(header,
                             kContentDispositionLength, header.size(),
                             RE2::UNANCHORED, groups, 2)) {
     value->set(groups[1].data(), groups[1].size());
     *value_assigned = true;
   }
   return true;
 }
 
 }  // namespace extensions