Added characters that look like padlocks to URL unescaping blacklist.

net/base/escape.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_ESCAPE_H_
 #define NET_BASE_ESCAPE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 74 matching lines @@
     // by other applications.
     SPACES = 2,
 
     // Unescapes various characters that will change the meaning of URLs,
     // including '%', '+', '&', '/', '#'. If we unescaped these characters, the
     // resulting URL won't be the same as the source one. This flag is used when
     // generating final output like filenames for URLs where we won't be
     // interpreting as a URL and want to do as much unescaping as possible.
     URL_SPECIAL_CHARS = 4,
 
-    // Unescapes control characters such as %01. This INCLUDES NULLs. This is
-    // used for rare cases such as data: URL decoding where the result is binary
-    // data. This flag also unescapes BiDi control characters.
+    // Unescapes characters that can be used in spoofing attempts (such as LOCK)
+    // and control characters (such as BiDi control characters and %01).  This
+    // INCLUDES NULLs.  This is used for rare cases such as data: URL decoding
+    // where the result is binary data.
     //
-    // DO NOT use CONTROL_CHARS if the URL is going to be displayed in the UI
-    // for security reasons.
-    CONTROL_CHARS = 8,
+    // DO NOT use SPOOFING_AND_CONTROL_CHARS if the URL is going to be displayed
+    // in the UI for security reasons.
+    SPOOFING_AND_CONTROL_CHARS = 8,
 
     // URL queries use "+" for space. This flag controls that replacement.
     REPLACE_PLUS_WITH_SPACE = 16,
   };
 };
 
 // Unescapes |escaped_text| and returns the result.
 // Unescaping consists of looking for the exact pattern "%XX", where each X is
 // a hex digit, and converting to the character with the numerical value of
 // those digits. Thus "i%20=%203%3b" unescapes to "i = 3;".
@@ skipping 23 matching lines @@
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments);
 
 // Unescapes the following ampersand character codes from |text|:
 // &lt; &gt; &amp; &quot; &#39;
 NET_EXPORT base::string16 UnescapeForHTML(const base::string16& text);
 
 }  // namespace net
 
 #endif  // NET_BASE_ESCAPE_H_