Correctly handle problematic nested escapes in URL paths.

url/url_canon_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <errno.h>
 
 #include "base/macros.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/third_party/mozilla/url_parse.h"
 #include "url/url_canon.h"
@@ skipping 1042 matching lines @@
       // Backslashes should get converted to forward slashes
     {"\\foo\\bar", L"\\foo\\bar", "/foo/bar", Component(0, 8), true},
       // Hashes found in paths (possibly only when the caller explicitly sets
       // the path on an already-parsed URL) should be escaped.
     {"/foo#bar", L"/foo#bar", "/foo%23bar", Component(0, 10), true},
       // %7f should be allowed and %3D should not be unescaped (these were wrong
       // in a previous version).
     {"/%7Ffp3%3Eju%3Dduvgw%3Dd", L"/%7Ffp3%3Eju%3Dduvgw%3Dd", "/%7Ffp3%3Eju%3Dduvgw%3Dd", Component(0, 24), true},
       // @ should be passed through unchanged (escaped or unescaped).
     {"/@asdf%40", L"/@asdf%40", "/@asdf%40", Component(0, 9), true},
+      // Nested escape sequences should not be unescaped.
+    {"/%0%30", L"/%0%30", "/%0%30", Component(0, 6), true},
+    {"/%%300", L"/%%300", "/%%300", Component(0, 6), true},
+      // If there are multiple nested escaped values, we'll unescape the first
+      // and only detect the potential problem when we reach the second.
+    {"/%%30%30", L"/%%30%30", "/%0%30", Component(0, 6), true},
+      // Make sure truncated "nested" escapes don't result in reading off the
+      // string end.
+    {"/%%30", L"/%%30", "/%0", Component(0, 3), true},
 
     // ----- encoding tests -----
       // Basic conversions
     {"/\xe4\xbd\xa0\xe5\xa5\xbd\xe4\xbd\xa0\xe5\xa5\xbd", L"/\x4f60\x597d\x4f60\x597d", "/%E4%BD%A0%E5%A5%BD%E4%BD%A0%E5%A5%BD", Component(0, 37), true},
       // Invalid unicode characters should fail. We only do validation on
       // UTF-16 input, so this doesn't happen on 8-bit.
     {"/\xef\xb7\x90zyx", NULL, "/%EF%B7%90zyx", Component(0, 13), true},
     {NULL, L"/\xfdd0zyx", "/%EF%BF%BDzyx", Component(0, 13), false},
   };
 
@@ skipping 1050 matching lines @@
   repl_output.Complete();
 
   // Generate the expected string and check.
   std::string expected("file:///foo?");
   for (size_t i = 0; i < new_query.length(); i++)
     expected.push_back('a');
   EXPECT_TRUE(expected == repl_str);
 }
 
 }  // namespace url