IDN Spoofs: Prevent Latin letter Kra from being decoded to unicode

This CL adds U+0138 to the list of blocked characters. As a result, any domain
with this character will always be displayed as punycode.

Bug: 964002
Change-Id: Iac63cb94bde9d8d668094c12b5042d55e8e44162
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1618562
Commit-Queue: Mustafa Emre Acer <meacer@chromium.org>
Reviewed-by: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#661125}

components/url_formatter/idn_spoof_checker.cc

@@ -490,6 +490,9 @@ void IDNSpoofChecker::SetAllowedUnicodeSet(UErrorCode* status) {
   // Block modifier letter voicing.
   allowed_set.remove(0x2ecu);
 
+  // Block historic character Latin Kra (also blocked by Mozilla).
+  allowed_set.remove(0x0138);
+
   // No need to block U+144A (Canadian Syllabics West-Cree P) separately
   // because it's blocked from mixing with other scripts including Latin.
 

components/url_formatter/url_formatter_unittest.cc

@@ -1030,6 +1030,9 @@ const IDNTestCase kIdnCases[] = {
 
     // Modifier-letter-voicing should be blocked (wwwˬtest.com).
     {"xn--wwwtest-2be.com", L"www\x02ectest.com", false},
+
+    // oĸ.com: Not a top domain, should be blocked because of Kra.
+    {"xn--o-tka.com", L"o\x0138.com", false},
 };
 
 struct AdjustOffsetCase {