Update from chromium a8e7c94b1b79a0948d05a1fcfff53391d22ce37a

net/base/escape.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_ESCAPE_H_
 #define NET_BASE_ESCAPE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 70 matching lines @@
 
     // Unescapes various characters that will change the meaning of URLs,
     // including '%', '+', '&', '/', '#'. If we unescaped these characters, the
     // resulting URL won't be the same as the source one. This flag is used when
     // generating final output like filenames for URLs where we won't be
     // interpreting as a URL and want to do as much unescaping as possible.
     URL_SPECIAL_CHARS = 4,
 
     // Unescapes control characters such as %01. This INCLUDES NULLs. This is
     // used for rare cases such as data: URL decoding where the result is binary
-    // data. You should not use this for normal URLs!
+    // data. This flag also unescapes BiDi control characters.
+    //
+    // DO NOT use CONTROL_CHARS if the URL is going to be displayed in the UI
+    // for security reasons.
     CONTROL_CHARS = 8,
 
     // URL queries use "+" for space. This flag controls that replacement.
     REPLACE_PLUS_WITH_SPACE = 16,
   };
 };
 
 // Unescapes |escaped_text| and returns the result.
 // Unescaping consists of looking for the exact pattern "%XX", where each X is
 // a hex digit, and converting to the character with the numerical value of
@@ skipping 24 matching lines @@
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments);
 
 // Unescapes the following ampersand character codes from |text|:
 // &lt; &gt; &amp; &quot; &#39;
 NET_EXPORT base::string16 UnescapeForHTML(const base::string16& text);
 
 }  // namespace net
 
 #endif  // NET_BASE_ESCAPE_H_