Chromium Code Reviews| Index: components/auto_login_parser/auto_login_parser.cc |
| diff --git a/components/auto_login_parser/auto_login_parser.cc b/components/auto_login_parser/auto_login_parser.cc |
| index 38fc633c8183e974e2ceb75a76498eff808a49bd..8f3c725d7fe7e33d9d0d9d64b8d42aa6df1d0081 100644 |
| --- a/components/auto_login_parser/auto_login_parser.cc |
| +++ b/components/auto_login_parser/auto_login_parser.cc |
| @@ -54,8 +54,10 @@ bool ParseHeader(const std::string& header, |
| ++it) { |
| const std::string& key = it->first; |
| const std::string& value = it->second; |
| - std::string unescaped_value( |
| - net::UnescapeURLComponent(value, net::UnescapeRule::URL_SPECIAL_CHARS)); |
| + std::string unescaped_value(net::UnescapeURLComponent( |
| + value, |
| + net::UnescapeRule::PATH_SEPARATORS | |
| + net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS)); |
|
mmenke
2016/03/16 21:30:00
Looks safe - not used as a path.
|
| if (key == "realm") { |
| if (!MatchRealm(unescaped_value, realm_restriction)) |
| return false; |