Block Tifinagh + Latin mix

components/url_formatter/idn_spoof_checker.cc

Index: components/url_formatter/idn_spoof_checker.cc
diff --git a/components/url_formatter/idn_spoof_checker.cc b/components/url_formatter/idn_spoof_checker.cc
index dbed171b9ea309fa7d9450f1c7fe07e597df6225..edcec7f89fcfa6d824c2fae0d2c4e5923bdff103 100644
--- a/components/url_formatter/idn_spoof_checker.cc
+++ b/components/url_formatter/idn_spoof_checker.cc
@@ -167,6 +167,7 @@ bool IDNSpoofChecker::SafeToDisplayAsUnicode(base::StringPiece16 label,
     //   Letter Co) to be next to Latin.
     // - Disallow Latin 'o' and 'g' next to Armenian.
     // - Disalow mixing of Latin and Canadian Syllabary.
+    // - Disalow mixing of Latin and Tifinagh.

[Peter Kasting, 2017/05/22 18:47:46]

Are there other "Latin + <script>" combos we should pre-emptively block?

     dangerous_pattern = new icu::RegexMatcher(
         icu::UnicodeString(
             R"([^\p{scx=kana}\p{scx=hira}\p{scx=hani}])"
@@ -181,7 +182,8 @@ bool IDNSpoofChecker::SafeToDisplayAsUnicode(base::StringPiece16 label,
             R"([a-z][\u0585\u0581]+[a-z]|)"
             R"(^[og]+[\p{scx=armn}]|[\p{scx=armn}][og]+$|)"
             R"([\p{scx=armn}][og]+[\p{scx=armn}]|)"
-            R"([\p{sc=cans}].*[a-z]|[a-z].*[\p{sc=cans}])",
+            R"([\p{sc=cans}].*[a-z]|[a-z].*[\p{sc=cans}]|)"
+            R"([\p{sc=tfng}].*[a-z]|[a-z].*[\p{sc=tfng}])",

[Peter Kasting, 2017/05/22 18:47:46]

Nit: Feels like there's maybe a less redundant way to write this regex, but it's
probably less readable.

             -1, US_INV),
         0, status);
     tls_index.Set(dangerous_pattern);