FileURLToFilePath: Don't unescape '/' and '\\'.

net/base/filename_util_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/filename_util.h"
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 221 matching lines @@
   FileCase url_cases[] = {
 #if defined(OS_WIN)
     {L"C:\\foo\\bar.txt", "file:c|/foo\\bar.txt"},
     {L"C:\\foo\\bar.txt", "file:/c:/foo/bar.txt"},
     {L"\\\\foo\\bar.txt", "file://foo\\bar.txt"},
     {L"C:\\foo\\bar.txt", "file:///c:/foo/bar.txt"},
     {L"\\\\foo\\bar.txt", "file:////foo\\bar.txt"},
     {L"\\\\foo\\bar.txt", "file:/foo/bar.txt"},
     {L"\\\\foo\\bar.txt", "file://foo\\bar.txt"},
     {L"C:\\foo\\bar.txt", "file:\\\\\\c:/foo/bar.txt"},
+    // %2f ('/') and %5c ('\\') are left alone by both GURL and
+    // FileURLToFilePath.
+    {L"C:\\foo%2f..%5cbar", "file:///C:\\foo%2f..%5cbar"},
 #elif defined(OS_POSIX)
     {L"/c:/foo/bar.txt", "file:/c:/foo/bar.txt"},
     {L"/c:/foo/bar.txt", "file:///c:/foo/bar.txt"},
     {L"/foo/bar.txt", "file:/foo/bar.txt"},
     {L"/c:/foo/bar.txt", "file:\\\\\\c:/foo/bar.txt"},
     {L"/foo/bar.txt", "file:foo/bar.txt"},
     {L"/bar.txt", "file://foo/bar.txt"},
     {L"/foo/bar.txt", "file:///foo/bar.txt"},
     {L"/foo/bar.txt", "file:////foo/bar.txt"},
     {L"/foo/bar.txt", "file:////foo//bar.txt"},
     {L"/foo/bar.txt", "file:////foo///bar.txt"},
     {L"/foo/bar.txt", "file:////foo////bar.txt"},
     {L"/c:/foo/bar.txt", "file:\\\\\\c:/foo/bar.txt"},
     {L"/c:/foo/bar.txt", "file:c:/foo/bar.txt"},
+    // %2f ('/') and %5c ('\\') are left alone by both GURL and
+    // FileURLToFilePath.
+    {L"/foo%2f..%5cbar", "file:///foo%2f..%5cbar"},
 //  We get these wrong because GURL turns back slashes into forward
 //  slashes.
 //  {L"/foo%5Cbar.txt", "file://foo\\bar.txt"},
 //  {L"/c|/foo%5Cbar.txt", "file:c|/foo\\bar.txt"},
 //  {L"/foo%5Cbar.txt", "file://foo\\bar.txt"},
 //  {L"/foo%5Cbar.txt", "file:////foo\\bar.txt"},
 //  {L"/foo%5Cbar.txt", "file://foo\\bar.txt"},
 #endif
   };
   for (size_t i = 0; i < arraysize(url_cases); i++) {
@@ skipping 512 matching lines @@
      L"\uc608\uc220 \uc608\uc220.jpg"},
     {// Invalid C-D. No filename from URL. Falls back to 'download'.
      __LINE__,
      "http://www.google.com/path1/path2/",
      "attachment; filename==?iso88591?Q?caf=E3?",
      "",
      "",
      "image/jpeg",
      L"download",
      L"download" JPEG_EXT},
+    {// Escaped slash, backslash, and leading periods in file name. The periods
+     // should be removed, both slashes replaced with dashes.
+     __LINE__,
+     "http://www.google.com/..%2f%5atest.html",
+     "",
+     "",
+     "",
+     "",
+     L"",
+     L"--test.html"},

[mmenke, 2016/02/17 22:59:59]

This isn't exactly related to the fix.  There's another use of URL_SPECIAL_CHARS
a in GetFileNameFromURL, and this tests that we correctly sanitize it (There are
tests here when these special characters are in the filename field already, but
no tests for them when they come from URLs).

   };
 
   // Tests filename generation.  Once the correct filename is
   // selected, they should be passed through the validation steps and
   // a correct extension should be added if necessary.
   const GenerateFilenameCase generation_tests[] = {
     // Dotfiles. Ensures preceeding period(s) stripped.
     {__LINE__, "http://www.google.com/.test.html", "", "", "", "", L"",
      L"test.html"},
     {__LINE__, "http://www.google.com/.test", "", "", "", "", L"", L"test"},
@@ skipping 269 matching lines @@
   }
 
   for (size_t i = 0; i < arraysize(kUnsafePortableBasenamesForWindows); ++i) {
     EXPECT_TRUE(IsReservedNameOnWindows(
         base::FilePath(kUnsafePortableBasenamesForWindows[i]).value()))
         << kUnsafePortableBasenamesForWindows[i];
   }
 }
 
 }  // namespace net