Don't autofill credit cards on non-secure pages

chrome/browser/ui/autofill/chrome_autofill_client.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/autofill/chrome_autofill_client.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/prefs/pref_service.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
@@ skipping 16 matching lines @@
 #include "chrome/browser/ui/tabs/tab_strip_model_observer.h"
 #include "chrome/browser/web_data_service_factory.h"
 #include "chrome/common/url_constants.h"
 #include "components/autofill/content/browser/content_autofill_driver.h"
 #include "components/autofill/content/common/autofill_messages.h"
 #include "components/autofill/core/browser/autofill_cc_infobar_delegate.h"
 #include "components/autofill/core/browser/ui/card_unmask_prompt_view.h"
 #include "components/autofill/core/common/autofill_pref_names.h"
 #include "components/password_manager/content/browser/content_password_manager_driver.h"
 #include "components/user_prefs/user_prefs.h"
+#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/render_frame_host.h"
 #include "ui/gfx/geometry/rect.h"
 
 #if defined(OS_ANDROID)
 #include "chrome/browser/android/chromium_application.h"
 #include "chrome/browser/ui/android/autofill/autofill_logger_android.h"
 #else
 #include "chrome/browser/ui/webui/signin/login_ui_service_factory.h"
 #include "components/ui/zoom/zoom_controller.h"
 #endif
@@ skipping 253 matching lines @@
   web_contents()->SendToAllFrames(
       new AutofillMsg_FirstUserGestureObservedInTab(routing_id()));
 }
 
 void ChromeAutofillClient::LinkClicked(const GURL& url,
                                        WindowOpenDisposition disposition) {
   web_contents()->OpenURL(content::OpenURLParams(
       url, content::Referrer(), disposition, ui::PAGE_TRANSITION_LINK, false));
 }
 
+bool ChromeAutofillClient::IsContextSecure(const GURL& form_origin) {
+  content::SSLStatus ssl_status;
+  content::NavigationEntry* navigation_entry =
+      web_contents()->GetController().GetLastCommittedEntry();
+  DCHECK(navigation_entry);
+  if (!navigation_entry)

[bondd, 2015/07/01 22:16:50]

AFAIK checking for DCHECK() failure like this is against the style guide.
See near the bottom of this page:
https://www.chromium.org/developers/coding-style
Search for "you should not handle DCHECK() failures"

[jww, 2015/07/01 22:25:45]

More specifically, this should not be a DCHECK() as the GetLastCommittedEntry()
contract states that it may return NULL, and DCHECK should not be used to handle
exceptional cases.

+     return false;
+
+  ssl_status = navigation_entry->GetSSL();
+  return ssl_status.security_style ==
+      content::SECURITY_STYLE_AUTHENTICATED &&
+      ssl_status.content_status == content::SSLStatus::NORMAL_CONTENT;
+}
+
 }  // namespace autofill