Omnibox - Do Not Allow HTTP/HTTPS Equivalence if User Explicitly Entered A Scheme

components/omnibox/autocomplete_match.cc

Index: components/omnibox/autocomplete_match.cc
diff --git a/components/omnibox/autocomplete_match.cc b/components/omnibox/autocomplete_match.cc
index d19f8e9b56031961555e2f2db05fc075080bfaa3..0a33b6f3e0401fa1de27e0d8181fc7bb52e32750 100644
--- a/components/omnibox/autocomplete_match.cc
+++ b/components/omnibox/autocomplete_match.cc
@@ -26,6 +26,26 @@ bool IsTrivialClassification(const ACMatchClassifications& classifications) {
        (classifications.back().style == ACMatchClassification::NONE));
 }
 
+// Returns true if one of the |terms_prefixed_by_http_or_https| matches the
+// beginning of the URL (sans scheme).  (Recall that
+// |terms_prefixed_by_http_or_https|, for the input "http://a b" will be
+// ["a"].)  This suggests that the user wants a particular URL with a scheme
+// in mind, hence the caller should not consider another URL like this one
+// but with a different scheme to be a duplicate.
+bool WordMatchesURLContent(
+    const std::vector<std::string>& terms_prefixed_by_http_or_https,
+    const GURL& url) {
+  const std::string& url_spec_without_scheme =
+      url.spec().substr(
+          url.scheme().length() +
+          strlen(url::kStandardSchemeSeparator));

[Peter Kasting, 2015/06/11 23:00:15]

You may want to do something like this:

  const size_t prefix_length =
      url.scheme().length() + strlen(url::kStandardSchemeSeparator);
  DCHECK_GE(url.spec().length(), prefix_length);
  const std::string& url_spec_without_scheme = url.spec().substr(prefix_length);

This is because substr() does not accept offsets longer than the string length
for the starting position, but we should be guaranteed that our offset isn't
longer than that by the conditionals done on the caller side.

[Mark P, 2015/06/12 20:23:20]

Good point.
Ah, that's why things work.
Done.

+  for (const auto& term : terms_prefixed_by_http_or_https) {
+    if (StartsWithASCII(url_spec_without_scheme, term, false))

[Peter Kasting, 2015/06/11 23:00:15]

This isn't right; we don't want an ASCII compare.

I'm not sure why string_util.h has ASCII and UTF-16 versions of StartsWith(),
and UTF-8 and UTF-16 versions of EndsWith().  This is weirdly inconsistent, and
you can see in the .cc file that StartsWithT<> was built to be used by both
UTF-8 and UTF-16 versions.

I would suggest adding a UTF-8 StartsWith() to string_util.h and then using that
here.

[Mark P, 2015/06/12 20:23:20]

I wondered the same thing.
Done.  I thought about this originally but I don't like touching base/ much. 
Thanks for your encouragement.

+      return true;
+  }
+  return false;
+}
+
 }  // namespace
 
 // AutocompleteMatch ----------------------------------------------------------
@@ -370,6 +390,7 @@ TemplateURL* AutocompleteMatch::GetTemplateURLWithKeyword(
 // static
 GURL AutocompleteMatch::GURLToStrippedGURL(
     const GURL& url,
+    const AutocompleteInput& input,
     TemplateURLService* template_url_service,
     const base::string16& keyword) {
   if (!url.is_valid())
@@ -415,8 +436,11 @@ GURL AutocompleteMatch::GURLToStrippedGURL(
     needs_replacement = true;
   }
 
-  // Replace https protocol with http protocol.
-  if (stripped_destination_url.SchemeIs(url::kHttpsScheme)) {
+  // Replace https protocol with http, as long as the user didn't explicitly
+  // specify one of the two.
+  if (stripped_destination_url.SchemeIs(url::kHttpsScheme) &&
+      (input.terms_prefixed_by_http_or_https().empty() ||
+       !WordMatchesURLContent(input.terms_prefixed_by_http_or_https(), url))) {
     replacements.SetScheme(url::kHttpScheme,
                            url::Component(0, strlen(url::kHttpScheme)));
     needs_replacement = true;
@@ -429,19 +453,21 @@ GURL AutocompleteMatch::GURLToStrippedGURL(
 }
 
 void AutocompleteMatch::ComputeStrippedDestinationURL(
+    const AutocompleteInput& input,
     TemplateURLService* template_url_service) {
-  stripped_destination_url =
-      GURLToStrippedGURL(destination_url, template_url_service, keyword);
+  stripped_destination_url = GURLToStrippedGURL(
+      destination_url, input, template_url_service, keyword);
 }
 
 void AutocompleteMatch::EnsureUWYTIsAllowedToBeDefault(
-    const GURL& canonical_input_url,
+    const AutocompleteInput& input,
     TemplateURLService* template_url_service) {
   if (!allowed_to_be_default_match) {
     const GURL& stripped_canonical_input_url =
         AutocompleteMatch::GURLToStrippedGURL(
-            canonical_input_url, template_url_service, base::string16());
-    ComputeStrippedDestinationURL(template_url_service);
+            input.canonicalized_url(), input, template_url_service,
+            base::string16());
+    ComputeStrippedDestinationURL(input, template_url_service);
     allowed_to_be_default_match =
         stripped_canonical_input_url == stripped_destination_url;
   }