Omnibox - Do Not Allow HTTP/HTTPS Equivalence if User Explicitly Entered A Scheme

components/omnibox/autocomplete_match.cc

Index: components/omnibox/autocomplete_match.cc
diff --git a/components/omnibox/autocomplete_match.cc b/components/omnibox/autocomplete_match.cc
index d19f8e9b56031961555e2f2db05fc075080bfaa3..541d1eead241b4128c412e13c9a7d16477481b66 100644
--- a/components/omnibox/autocomplete_match.cc
+++ b/components/omnibox/autocomplete_match.cc
@@ -26,6 +26,32 @@ bool IsTrivialClassification(const ACMatchClassifications& classifications) {
        (classifications.back().style == ACMatchClassification::NONE));
 }
 
+// Returns true if one of the input words includes a scheme and followed by
+// something that matches at the beginning of the URL's hostname.  This
+// indicates that the user desires this URL loaded with this scheme in
+// particular.
+bool InputIncludesSchemePlusPartOfHost(
+    const std::vector<base::string16>& input_words,
+    const GURL& url) {
+  // Find scheme separator and see if the stuff following it matches the
+  // beginning of the URL (after the scheme).
+  const base::string16& separator_as_utf16 =
+      base::UTF8ToUTF16(url::kStandardSchemeSeparator);
+  const base::string16& url_spec_without_scheme_as_utf16 =
+      base::UTF8ToUTF16(url.spec().substr(
+          url.scheme().length() +
+          std::string(url::kStandardSchemeSeparator).length()));

[Peter Kasting, 2015/06/01 21:04:08]

Why not just url.host().begin?

[Mark P, 2015/06/01 22:05:50]

If there is a username or password, url.host() position will be wrong.  I could
write conditional logic to figure out the position depending on the presence of
either of those two fields.  This + length seemed simplier.

[Peter Kasting, 2015/06/01 22:21:58]

Maybe url.GetContent() then?

[Mark P, 2015/06/04 23:31:31]

I think that's still ugly.  It's require a shift because GetContent returns, for
example, //www.google.com
(i.e., it's everything after the colon, not the scheme separator)

+  for (auto it : input_words) {
+    const size_t pos = it.find(separator_as_utf16);
+    if ((pos != base::string16::npos) &&
+        StartsWith(url_spec_without_scheme_as_utf16,
+                  it.substr(pos + separator_as_utf16.length()), false)) {

[Peter Kasting, 2015/06/01 21:04:08]

Won't this find input like "://foo"?  Shouldn't we be checking for the input to
actually have a scheme?

[Mark P, 2015/06/01 22:05:50]

Yes.  Do you want me to add a length>0 check?

[Peter Kasting, 2015/06/01 22:21:58]

Maybe instead we should do something like check url::IsStandard(it.data(),
url::Component(0, pos)).

[Mark P, 2015/06/04 23:31:31]

I'll prefer to add the >0 test.  I don't see any reason to require that the
scheme the user entered is a standard scheme.  Matching the suggestion is enough
(though in reality I don't think we ever suggest anything with non-standard
scheme).

+      return true;
+    }
+  }
+  return false;
+}
+
 }  // namespace
 
 // AutocompleteMatch ----------------------------------------------------------
@@ -370,6 +396,7 @@ TemplateURL* AutocompleteMatch::GetTemplateURLWithKeyword(
 // static
 GURL AutocompleteMatch::GURLToStrippedGURL(
     const GURL& url,
+    const std::vector<base::string16>& input_words,
     TemplateURLService* template_url_service,
     const base::string16& keyword) {
   if (!url.is_valid())
@@ -415,8 +442,9 @@ GURL AutocompleteMatch::GURLToStrippedGURL(
     needs_replacement = true;
   }
 
-  // Replace https protocol with http protocol.
-  if (stripped_destination_url.SchemeIs(url::kHttpsScheme)) {
+  // Possibly replace https protocol with http protocol.
+  if (!InputIncludesSchemePlusPartOfHost(input_words, url) &&
+      stripped_destination_url.SchemeIs(url::kHttpsScheme)) {
     replacements.SetScheme(url::kHttpScheme,
                            url::Component(0, strlen(url::kHttpScheme)));
     needs_replacement = true;
@@ -429,19 +457,22 @@ GURL AutocompleteMatch::GURLToStrippedGURL(
 }
 
 void AutocompleteMatch::ComputeStrippedDestinationURL(
+    const std::vector<base::string16>& input_words,
     TemplateURLService* template_url_service) {
-  stripped_destination_url =
-      GURLToStrippedGURL(destination_url, template_url_service, keyword);
+  stripped_destination_url = GURLToStrippedGURL(
+      destination_url, input_words, template_url_service, keyword);
 }
 
 void AutocompleteMatch::EnsureUWYTIsAllowedToBeDefault(
     const GURL& canonical_input_url,
+    const std::vector<base::string16>& input_words,
     TemplateURLService* template_url_service) {
   if (!allowed_to_be_default_match) {
     const GURL& stripped_canonical_input_url =
         AutocompleteMatch::GURLToStrippedGURL(
-            canonical_input_url, template_url_service, base::string16());
-    ComputeStrippedDestinationURL(template_url_service);
+            canonical_input_url, input_words,
+            template_url_service, base::string16());
+    ComputeStrippedDestinationURL(input_words, template_url_service);
     allowed_to_be_default_match =
         stripped_canonical_input_url == stripped_destination_url;
   }