Correctly handle problematic nested escapes in URL paths.

url/url_canon_unittest.cc

Index: url/url_canon_unittest.cc
diff --git a/url/url_canon_unittest.cc b/url/url_canon_unittest.cc
index 0ccd6c93009efa94faf0be1a3a95a2b169e96158..db1b60e4e0bb93986efe3e1ac3f8b7a1692a66c0 100644
--- a/url/url_canon_unittest.cc
+++ b/url/url_canon_unittest.cc
@@ -1060,6 +1060,15 @@ TEST(URLCanonTest, Path) {
     {"/%7Ffp3%3Eju%3Dduvgw%3Dd", L"/%7Ffp3%3Eju%3Dduvgw%3Dd", "/%7Ffp3%3Eju%3Dduvgw%3Dd", Component(0, 24), true},
       // @ should be passed through unchanged (escaped or unescaped).
     {"/@asdf%40", L"/@asdf%40", "/@asdf%40", Component(0, 9), true},
+      // Nested escape sequences should not be unescaped.
+    {"/%0%30", L"/%0%30", "/%0%30", Component(0, 6), true},
+    {"/%%300", L"/%%300", "/%%300", Component(0, 6), true},
+      // If there are multiple nested escaped values, we'll unescape the first
+      // and only detect the potential problem when we reach the second.
+    {"/%%30%30", L"/%%30%30", "/%0%30", Component(0, 6), true},
+      // Make sure truncated "nested" escapes don't result in reading off the
+      // string end.
+    {"/%%30", L"/%%30", "/%0", Component(0, 3), true},
 
     // ----- encoding tests -----
       // Basic conversions