Remove UnescapeRule::URL_SPECIAL_CHARS from components/

components/password_manager/core/browser/affiliation_utils.cc

Index: components/password_manager/core/browser/affiliation_utils.cc
diff --git a/components/password_manager/core/browser/affiliation_utils.cc b/components/password_manager/core/browser/affiliation_utils.cc
index 853edc528923524e8356a6b51775f7a89150eec6..31e521716b42ba0d48d6dc8b3fc67f42f75c7166 100644
--- a/components/password_manager/core/browser/affiliation_utils.cc
+++ b/components/password_manager/core/browser/affiliation_utils.cc
@@ -100,9 +100,12 @@ bool CanonicalizeHashComponent(const base::StringPiece& input_hash,
   // safe" base64 alphabet; plus the padding ('=').
   const char kBase64NonAlphanumericChars[] = "-_=";
 
-  // We need net::UnescapeRule::URL_SPECIAL_CHARS to unescape the padding ('=').
+  // We need net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS to
+  // unescape the padding ('=').

[mmenke, 2016/03/16 21:30:01]

Comment indicates that PATH_SEPARATORS isn't needed, but I'm erring on the side
of keeping old behavior.  Doesn't seem like a potential security issue.

[engedy, 2016/03/17 09:51:25]

Yes, we can safely remove net::UnescapeRule::PATH_SEPARATORS.  In fact, we
should remove it, in order to avoid confusing future readers of this code.

In case of benevolent input, there will be no escaped path separators in it.  In
case of malicious input, the ContainsOnlyAlphanumericAnd(...) check below will
still fail if escape sequences remain in |base64_encoded_hash|.  So in either
case, there is no change.

Thank you for being so thorough!

[mmenke, 2016/03/17 19:33:33]

Done, updated CL description.

   std::string base64_encoded_hash = net::UnescapeURLComponent(
-      input_hash.as_string(), net::UnescapeRule::URL_SPECIAL_CHARS);
+      input_hash.as_string(),
+      net::UnescapeRule::PATH_SEPARATORS |
+          net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS);
 
   if (!base64_encoded_hash.empty() &&
       CanonicalizeBase64Padding(&base64_encoded_hash) &&