Remove UnescapeRule::URL_SPECIAL_CHARS from components/

components/url_formatter/url_fixer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/url_formatter/url_fixer.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 
@@ skipping 602 matching lines @@
   if (gurl.is_valid() && gurl.IsStandard())
     is_file = false;
   base::FilePath full_path;
   if (is_file && !ValidPathForFile(trimmed, &full_path)) {
 // Not a path as entered, try unescaping it in case the user has
 // escaped things. We need to go through 8-bit since the escaped values
 // only represent 8-bit values.
 #if defined(OS_WIN)
     std::wstring unescaped = base::UTF8ToWide(net::UnescapeURLComponent(
         base::WideToUTF8(trimmed),
-        net::UnescapeRule::SPACES | net::UnescapeRule::URL_SPECIAL_CHARS));
+        net::UnescapeRule::SPACES | net::UnescapeRule::PATH_SEPARATORS |
+            net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS));

[mmenke, 2016/03/16 21:30:01]

Since this is only done on paths from the command line, it doesn't seem like
this is a problem (At least not in Chrome, suppose if some external source did
path validation before passing them in to us on the command line, could be a
problem).

[Peter Kasting, 2016/03/17 06:03:02]

I don't think I understand this comment: what does "this is a problem" mean?

[mmenke, 2016/03/17 09:23:21]

A security problem.  Applying this to file URLs generated by other file URLs
could violate whatever security model we have, and then this code changes the
path, we could be in trouble.  I am, admittedly, not familiar with the
cross-path security model for file URLs, but if some code thinks
file:///foo/..%2fbaz is inside foo (Which is what it really means, according to
GURL and net/), this code would turn it into file:///foo/../baz/, which GURL
would then turn into file:///baz/.

 #elif defined(OS_POSIX)
     std::string unescaped = net::UnescapeURLComponent(
         trimmed,
-        net::UnescapeRule::SPACES | net::UnescapeRule::URL_SPECIAL_CHARS);
+        net::UnescapeRule::SPACES | net::UnescapeRule::PATH_SEPARATORS |
+            net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS);
 #endif
 
     if (!ValidPathForFile(unescaped, &full_path))
       is_file = false;
   }
 
   // Put back the current directory if we saved it.
   if (!base_dir.empty())
     base::SetCurrentDirectory(old_cur_directory);
 
@@ skipping 30 matching lines @@
 }
 
 bool IsEquivalentScheme(const std::string& scheme1,
                         const std::string& scheme2) {
   return scheme1 == scheme2 ||
          (scheme1 == url::kAboutScheme && scheme2 == kChromeUIScheme) ||
          (scheme1 == kChromeUIScheme && scheme2 == url::kAboutScheme);
 }
 
 }  // namespace url_formatter