Unescape BiDi control chars while parsing data urls

net/base/escape.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_ESCAPE_H_
 #define NET_BASE_ESCAPE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 75 matching lines @@
     // interpreting as a URL and want to do as much unescaping as possible.
     URL_SPECIAL_CHARS = 4,
 
     // Unescapes control characters such as %01. This INCLUDES NULLs. This is
     // used for rare cases such as data: URL decoding where the result is binary
     // data. You should not use this for normal URLs!
     CONTROL_CHARS = 8,
 
     // URL queries use "+" for space. This flag controls that replacement.
     REPLACE_PLUS_WITH_SPACE = 16,
+
+    // Unescapes Bidi characters such as RTL/LTR marks. This should only be used
+    // when parsing data urls, but never be used when displaying the url in
+    // the omnibox. URLs in the omnibox should always escape BiDi control
+    // characters for security reasons.
+    // DO NOT use BIDI_CONTROL_CHARS flag without talking to a security person.
+    BIDI_CONTROL_CHARS = 32,
   };
 };
 
 // Unescapes |escaped_text| and returns the result.
 // Unescaping consists of looking for the exact pattern "%XX", where each X is
 // a hex digit, and converting to the character with the numerical value of
 // those digits. Thus "i%20=%203%3b" unescapes to "i = 3;".
 //
 // Watch out: this doesn't necessarily result in the correct final result,
 // because the encoding may be unknown. For example, the input might be ASCII,
@@ skipping 20 matching lines @@
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments);
 
 // Unescapes the following ampersand character codes from |text|:
 // &lt; &gt; &amp; &quot; &#39;
 NET_EXPORT base::string16 UnescapeForHTML(const base::string16& text);
 
 }  // namespace net
 
 #endif  // NET_BASE_ESCAPE_H_