Remove some uses of UnescapeRule::URL_SPECIAL_CHARS outside net/.

We're removing this, in favor of PATH_SEPARATORS and
URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS, to reduce the
risk of security issues when unescaping, going forward.

BUG=589257

Review URL: https://codereview.chromium.org/1820333003

Cr-Commit-Position: refs/heads/master@{#382935}

5 files changed, 17 insertions, 12 deletions

diff --git a/content/browser/indexed_db/indexed_db_browsertest.cc b/content/browser/indexed_db/indexed_db_browsertest.cc
index c23be28..9a53bc6 100644
--- a/content/browser/indexed_db/indexed_db_browsertest.cc
+++ b/content/browser/indexed_db/indexed_db_browsertest.cc
@@ -633,12 +633,14 @@ static scoped_ptr<net::test_server::HttpResponse> CorruptDBRequestHandler(
       std::string key = net::UnescapeURLComponent(
           escaped_key,
           net::UnescapeRule::NORMAL | net::UnescapeRule::SPACES |
-              net::UnescapeRule::URL_SPECIAL_CHARS);
+              net::UnescapeRule::PATH_SEPARATORS |
+              net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS);
 
       std::string value = net::UnescapeURLComponent(
           escaped_value,
           net::UnescapeRule::NORMAL | net::UnescapeRule::SPACES |
-              net::UnescapeRule::URL_SPECIAL_CHARS);
+              net::UnescapeRule::PATH_SEPARATORS |
+              net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS);
 
       if (key == "method")
         fail_method = value;
diff --git a/content/browser/web_contents/web_drag_source_mac.mm b/content/browser/web_contents/web_drag_source_mac.mm
index 94ba599..14321f4 100644
--- a/content/browser/web_contents/web_drag_source_mac.mm
+++ b/content/browser/web_contents/web_drag_source_mac.mm
@@ -174,8 +174,8 @@ void PromiseWriterHelper(const DropData& drop_data,
     // Strip out any existing escapes and then re-escape uniformly.
     if (!url && dropData_->url.SchemeIs(url::kJavaScriptScheme)) {
       net::UnescapeRule::Type unescapeRules =
-          net::UnescapeRule::SPACES |
-          net::UnescapeRule::URL_SPECIAL_CHARS |
+          net::UnescapeRule::SPACES | net::UnescapeRule::PATH_SEPARATORS |
+          net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS |
           net::UnescapeRule::SPOOFING_AND_CONTROL_CHARS;
       std::string unescapedUrlString =
           net::UnescapeURLComponent(dropData_->url.spec(), unescapeRules);
diff --git a/content/test/mock_google_streaming_server.cc b/content/test/mock_google_streaming_server.cc
index 3484ca3..44b48d0 100644
--- a/content/test/mock_google_streaming_server.cc
+++ b/content/test/mock_google_streaming_server.cc
@@ -46,9 +46,9 @@ void MockGoogleStreamingServer::OnRequestStart(int fetcher_id) {
   // Extract request argument from the the request URI.
   std::string query = GetURLFetcher(true)->GetOriginalURL().query();
   const net::UnescapeRule::Type kUnescapeAll =
-      net::UnescapeRule::NORMAL |
-      net::UnescapeRule::SPACES |
-      net::UnescapeRule::URL_SPECIAL_CHARS |
+      net::UnescapeRule::NORMAL | net::UnescapeRule::SPACES |
+      net::UnescapeRule::PATH_SEPARATORS |
+      net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS |
       net::UnescapeRule::REPLACE_PLUS_WITH_SPACE;
   for (const base::StringPiece& query_param :
        base::SplitStringPiece(query, "&", base::KEEP_WHITESPACE,
diff --git a/google_apis/gcm/engine/registration_request_unittest.cc b/google_apis/gcm/engine/registration_request_unittest.cc
index 9a8ab01..4dcebd7 100644
--- a/google_apis/gcm/engine/registration_request_unittest.cc
+++ b/google_apis/gcm/engine/registration_request_unittest.cc
@@ -181,8 +181,10 @@ TEST_F(GCMRegistrationRequestTest, RequestRegistrationWithMultipleSenderIds) {
     continue;
 
   ASSERT_TRUE(data_tokenizer.GetNext());
-  std::string senders(net::UnescapeURLComponent(data_tokenizer.token(),
-      net::UnescapeRule::URL_SPECIAL_CHARS));
+  std::string senders(net::UnescapeURLComponent(
+      data_tokenizer.token(),
+      net::UnescapeRule::PATH_SEPARATORS |
+          net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS));
   base::StringTokenizer sender_tokenizer(senders, ",");
   ASSERT_TRUE(sender_tokenizer.GetNext());
   EXPECT_EQ("sender1", sender_tokenizer.token());
diff --git a/ui/base/webui/web_ui_util.cc b/ui/base/webui/web_ui_util.cc
index e83ea68..0f91f3f 100644
--- a/ui/base/webui/web_ui_util.cc
+++ b/ui/base/webui/web_ui_util.cc
@@ -91,9 +91,10 @@ bool ParseScaleFactor(const base::StringPiece& identifier,
 void ParsePathAndScale(const GURL& url,
                        std::string* path,
                        float* scale_factor) {
-  *path = net::UnescapeURLComponent(url.path().substr(1),
-                                    (net::UnescapeRule::URL_SPECIAL_CHARS |
-                                     net::UnescapeRule::SPACES));
+  *path = net::UnescapeURLComponent(
+      url.path().substr(1),
+      net::UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS |
+          net::UnescapeRule::SPACES);
   if (scale_factor)
     *scale_factor = 1.0f;