Don't re-store deleted passwords on form submit on the Mac

chrome/browser/password_manager/password_store_mac.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/password_manager/password_store_mac.h"
 #include "chrome/browser/password_manager/password_store_mac_internal.h"
 
 #include <CoreServices/CoreServices.h>
 #include <set>
 #include <string>
@@ skipping 486 matching lines @@
     PasswordForm* form = new PasswordForm();
     internal_keychain_helpers::FillPasswordFormFromKeychainItem(*keychain_,
                                                                 keychain_item,
                                                                 form);
     keychain_->Free(keychain_item);
     return form;
   }
   return NULL;
 }
 
+bool MacKeychainPasswordFormAdapter::HasPasswordsMergeableWithForm(
+    const PasswordForm& query_form) {
+  std::string username = UTF16ToUTF8(query_form.username_value);
+  std::vector<SecKeychainItemRef> matches =
+      MatchingKeychainItems(query_form.signon_realm, query_form.scheme,
+                            NULL, username.c_str());
+  for (std::vector<SecKeychainItemRef>::iterator i = matches.begin();
+       i != matches.end(); ++i) {
+    keychain_->Free(*i);
+  }
+
+  return matches.size() != 0;
+}
+
 std::vector<PasswordForm*>
     MacKeychainPasswordFormAdapter::GetAllPasswordFormPasswords() {
   SecAuthenticationType supported_auth_types[] = {
     kSecAuthenticationTypeHTMLForm,
     kSecAuthenticationTypeHTTPBasic,
     kSecAuthenticationTypeHTTPDigest,
   };
 
   std::vector<SecKeychainItemRef> matches;
   for (unsigned int i = 0; i < arraysize(supported_auth_types); ++i) {
@@ skipping 238 matching lines @@
       changes.push_back(PasswordStoreChange(PasswordStoreChange::ADD, form));
       NotificationService::current()->Notify(
           NotificationType::LOGINS_CHANGED,
           NotificationService::AllSources(),
           Details<PasswordStoreChangeList>(&changes));
     }
   }
 }
 
 void PasswordStoreMac::UpdateLoginImpl(const PasswordForm& form) {
+  int update_count = 0;
+  if (!login_metadata_db_->UpdateLogin(form, &update_count))
+    return;
+
+  MacKeychainPasswordFormAdapter keychain_adapter(keychain_.get());
+  if (update_count == 0 &&
+      !keychain_adapter.HasPasswordsMergeableWithForm(form)) {
+    // If the password isn't in either the DB or the keychain, then it must have
+    // been deleted after autofill happened, and should not be re-added.
+    return;
+  }
+
   // The keychain add will update if there is a collision and add if there
   // isn't, which is the behavior we want, so there's no separate update call.
   if (AddToKeychainIfNecessary(form)) {
-    int update_count = 0;
-    if (login_metadata_db_->UpdateLogin(form, &update_count)) {
-      // Update will catch any database entries that we already had, but we
-      // could also be updating a keychain-only form, in which case we need to
-      // add.
-      PasswordStoreChangeList changes;
-      if (update_count == 0) {
-        if (login_metadata_db_->AddLogin(form)) {
-          changes.push_back(PasswordStoreChange(PasswordStoreChange::ADD,
-                                                form));
-        }
-      } else {
-        changes.push_back(PasswordStoreChange(PasswordStoreChange::UPDATE,
+    PasswordStoreChangeList changes;
+    if (update_count == 0) {
+      if (login_metadata_db_->AddLogin(form)) {
+        changes.push_back(PasswordStoreChange(PasswordStoreChange::ADD,
                                               form));
       }
-      if (!changes.empty()) {
-        NotificationService::current()->Notify(
-            NotificationType::LOGINS_CHANGED,
-            NotificationService::AllSources(),
-            Details<PasswordStoreChangeList>(&changes));
-      }
+    } else {
+      changes.push_back(PasswordStoreChange(PasswordStoreChange::UPDATE,
+                                            form));
+    }
+    if (!changes.empty()) {
+      NotificationService::current()->Notify(
+          NotificationType::LOGINS_CHANGED,
+          NotificationService::AllSources(),
+          Details<PasswordStoreChangeList>(&changes));
     }
   }
 }
 
 void PasswordStoreMac::RemoveLoginImpl(const PasswordForm& form) {
   if (login_metadata_db_->RemoveLogin(form)) {
     // See if we own a Keychain item associated with this item. We can do an
     // exact search rather than messing around with trying to do fuzzy matching
     // because passwords that we created will always have an exact-match
     // database entry.
@@ skipping 183 matching lines @@
   owned_keychain_adapter.SetFindsOnlyOwnedItems(true);
   for (std::vector<PasswordForm*>::const_iterator i = forms.begin();
        i != forms.end(); ++i) {
     owned_keychain_adapter.RemovePassword(**i);
   }
 }
 
 void PasswordStoreMac::CreateNotificationService() {
   notification_service_.reset(new NotificationService);
 }