Added characters that look like padlocks to URL unescaping blacklist.

extensions/browser/api/web_request/form_data_parser.cc

Index: extensions/browser/api/web_request/form_data_parser.cc
diff --git a/extensions/browser/api/web_request/form_data_parser.cc b/extensions/browser/api/web_request/form_data_parser.cc
index 2e962dde1deb7bf6490d0afa5cb77ab3db9c43d4..31b6fe8aadfa1ebde9672f6fabcb9b76e107f165 100644
--- a/extensions/browser/api/web_request/form_data_parser.cc
+++ b/extensions/browser/api/web_request/form_data_parser.cc
@@ -350,8 +350,9 @@ scoped_ptr<FormDataParser> FormDataParser::CreateFromContentTypeHeader(
 FormDataParser::FormDataParser() {}
 
 const net::UnescapeRule::Type FormDataParserUrlEncoded::unescape_rules_ =
-    net::UnescapeRule::URL_SPECIAL_CHARS | net::UnescapeRule::CONTROL_CHARS |
-    net::UnescapeRule::SPACES | net::UnescapeRule::REPLACE_PLUS_WITH_SPACE;
+    net::UnescapeRule::URL_SPECIAL_CHARS |
+    net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS | net::UnescapeRule::SPACES |
+    net::UnescapeRule::REPLACE_PLUS_WITH_SPACE;
 
 FormDataParserUrlEncoded::FormDataParserUrlEncoded()
     : source_(NULL),
@@ -516,8 +517,8 @@ bool FormDataParserMultipart::GetNextNameValue(Result* result) {
   }
 
   std::string unescaped_name = net::UnescapeURLComponent(
-      name.as_string(),
-      net::UnescapeRule::URL_SPECIAL_CHARS | net::UnescapeRule::CONTROL_CHARS);
+      name.as_string(), net::UnescapeRule::URL_SPECIAL_CHARS |
+                            net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS);
   result->set_name(unescaped_name);
   result->set_value(value);