Code: bool DoCanonicalizePathComponent(const CHAR* source,
                                  const Component& component,
                                  char separator,
                                  CanonOutput* output,
                                  Component* new_component) {
  bool success = true;
   if (component.is_valid()) {
     if (separator)
       output->push_back(separator);
    new_component->begin = output->length();
    int end = component.end();
     for (int i = component.begin; i < end; i++) {
       UCHAR uch = static_cast<UCHAR>(source[i]);
       if (uch < 0x20 || uch >= 0x80)
        success &= AppendUTF8EscapedChar(source, &i, end, output);
       else
         output->push_back(static_cast<char>(uch));
     }
    new_component->len = output->length() - new_component->begin;
  } else {
     new_component->reset();
   }
  return success;
 }

Vulnerability Type: Bypass 
CWE ID: CWE-20
Summary: Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
Commit Message: [url] Make path URL parsing more lax

Parsing the path component of a non-special URL like javascript or data
should not fail for invalid URL characters like \uFFFF. See this bit
in the spec:
https://url.spec.whatwg.org/#cannot-be-a-base-url-path-state

Note: some failing WPTs are added which are because url parsing
replaces invalid characters (e.g. \uFFFF) with the replacement char
\uFFFD, when that isn't in the spec.

Bug: 925614
Change-Id: I450495bfdfa68dc70334ebed16a3ecc0d5737e88
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1551917
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Charlie Harrison <csharrison@chromium.org>
Cr-Commit-Position: refs/heads/master@{#648155}