Omnibox - Do Not Allow HTTP/HTTPS Equivalence if User Explicitly Entered A Scheme

components/omnibox/autocomplete_input.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/omnibox/autocomplete_input.h"
 
+#include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/metrics/proto/omnibox_event.pb.h"
 #include "components/omnibox/autocomplete_scheme_classifier.h"
 #include "components/url_fixer/url_fixer.h"
 #include "net/base/net_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "url/url_canon_ip.h"
 #include "url/url_util.h"
 
 namespace {
 
 // Hardcode constant to avoid any dependencies on content/.
 const char kViewSourceScheme[] = "view-source";
 
 void AdjustCursorPositionIfNecessary(size_t num_leading_chars_removed,
                                      size_t* cursor_position) {
   if (*cursor_position == base::string16::npos)
     return;
   if (num_leading_chars_removed < *cursor_position)
     *cursor_position -= num_leading_chars_removed;
   else
     *cursor_position = 0;
 }
 
+// Finds all terms in |text| that start with http:// or https:// plus at least
+// one more character and puts the text after the prefix in
+// |terms_prefixed_by_http_or_https|.
+void PopulateTermsPrefixedByScheme(
+    const base::string16& text,
+    std::vector<base::string16>* terms_prefixed_by_http_or_https) {

[Peter Kasting, 2015/06/11 05:21:44]

Nit: Call this |terms_prefixed_by_scheme| to match the function name (or change
the function name).

I might pick that name for the class member/function as well, just for the
brevity, but up to you.

[Mark P, 2015/06/11 22:11:41]

I'd rather the increase in precision of http_or_https because this isn't terms
prefixed by any scheme.  Instead, I revised the function match to make them
match.

+  base::string16 kPrefixes[2] = {

[Peter Kasting, 2015/06/11 05:21:44]

Even if you were to stick with string16 (which I don't want), doing the
conversions in the loop is shorter because you only need to write them once
instead of twice.  Also, you'd want to use ASCIIToUTF16() instead.

[Mark P, 2015/06/11 22:11:41]

Acknowledged.  Now obsolete.

+      base::UTF8ToUTF16(url::kHttpScheme) +
+          base::UTF8ToUTF16(url::kStandardSchemeSeparator),
+      base::UTF8ToUTF16(url::kHttpsScheme) +
+          base::UTF8ToUTF16(url::kStandardSchemeSeparator)
+  };
+  std::vector<base::string16> terms;
+  // Split on whitespace rather than use ICU's word iterator because, for
+  // examples, ICU's iterator may break on punctuation (such as ://) or decide

[Peter Kasting, 2015/06/11 05:21:44]

Nit: example

[Mark P, 2015/06/11 22:11:41]

Done.

+  // to split a single term in a hostname (if it seems to think that the
+  // hostname is multiple words).  Neither of these behaviors are desirable.

[Peter Kasting, 2015/06/11 05:21:44]

Nit: are -> is ("neither" is singular)

[Mark P, 2015/06/11 22:11:41]

Done.

+  base::SplitString(text, ' ', &terms);
+  for (const auto& term : terms) {
+    for (const auto& prefix : kPrefixes) {
+      if (StartsWith(term, prefix, false) &&
+          (term.length() > prefix.length())) {
+        terms_prefixed_by_http_or_https->push_back(
+            term.substr(prefix.length()));
+      }
+    }
+  }
+}
+
 }  // namespace
 
 AutocompleteInput::AutocompleteInput()
     : cursor_position_(base::string16::npos),
       current_page_classification_(metrics::OmniboxEventProto::INVALID_SPEC),
       type_(metrics::OmniboxInputType::INVALID),
       prevent_inline_autocomplete_(false),
       prefer_keyword_(false),
       allow_exact_keyword_match_(true),
       want_asynchronous_matches_(true) {
@@ skipping 23 matching lines @@
   // None of the providers care about leading white space so we always trim it.
   // Providers that care about trailing white space handle trimming themselves.
   if ((base::TrimWhitespace(text, base::TRIM_LEADING, &text_) &
        base::TRIM_LEADING) != 0)
     AdjustCursorPositionIfNecessary(text.length() - text_.length(),
                                     &cursor_position_);
 
   GURL canonicalized_url;
   type_ = Parse(text_, desired_tld, scheme_classifier, &parts_, &scheme_,
                 &canonicalized_url);
+  PopulateTermsPrefixedByScheme(text_, &terms_prefixed_by_http_or_https_);
 
   if (type_ == metrics::OmniboxInputType::INVALID)
     return;
 
   if (((type_ == metrics::OmniboxInputType::UNKNOWN) ||
        (type_ == metrics::OmniboxInputType::URL)) &&
       canonicalized_url.is_valid() &&
       (!canonicalized_url.IsStandard() || canonicalized_url.SchemeIsFile() ||
        canonicalized_url.SchemeIsFileSystem() ||
        !canonicalized_url.host().empty()))
@@ skipping 440 matching lines @@
   current_url_ = GURL();
   current_page_classification_ = metrics::OmniboxEventProto::INVALID_SPEC;
   type_ = metrics::OmniboxInputType::INVALID;
   parts_ = url::Parsed();
   scheme_.clear();
   canonicalized_url_ = GURL();
   prevent_inline_autocomplete_ = false;
   prefer_keyword_ = false;
   allow_exact_keyword_match_ = false;
   want_asynchronous_matches_ = true;
+  terms_prefixed_by_http_or_https_.clear();
 }