Implementation of sensitive card information escrowing

chrome/browser/autofill/wallet/wallet_client.cc

Index: chrome/browser/autofill/wallet/wallet_client.cc
diff --git a/chrome/browser/autofill/wallet/wallet_client.cc b/chrome/browser/autofill/wallet/wallet_client.cc
index 27e1f475d65ca296594641a788ea59f4f71b3228..af67575662219baabfc88c46f96f7711d1bfa8b5 100644
--- a/chrome/browser/autofill/wallet/wallet_client.cc
+++ b/chrome/browser/autofill/wallet/wallet_client.cc
@@ -25,6 +25,7 @@
 namespace {
 
 const char kEncryptOtpBodyFormat[] = "cvv=%s:%s";
+const char kEscrowSensitiveInformationFormat[] = "gid=%s&cardNumber=%s&cvv=%s";
 const char kJsonMimeType[] = "application/json";
 const char kApplicationMimeType[] = "application/x-www-form-urlencoded";
 const size_t kMaxBits = 63;
@@ -75,9 +76,30 @@ void WalletClient::EncryptOtp(
                                        base::HexEncode(&num_bits, 1).c_str(),
                                        base::HexEncode(otp, length).c_str());
 
-  MakeWalletRequest(GetSecureUrl(), post_body, observer, kApplicationMimeType);
+  MakeWalletRequest(GetEncryptionUrl(),
+                    post_body,
+                    observer,
+                    kApplicationMimeType);
 }
 
+void WalletClient::EscrowSensitiveInformation(
+    const std::string& pan,
+    const std::string& cvn,
+    const std::string& obfuscated_gaia_id,
+    WalletClient::WalletClientObserver* observer) {
+  DCHECK_EQ(request_type_, NO_PENDING_REQUEST);
+
+  request_type_ = ESCROW_SENSITIVE_INFORMATION;
+
+  std::string post_body = StringPrintf(kEscrowSensitiveInformationFormat,
+                                       obfuscated_gaia_id.c_str(),
+                                       pan.c_str(),
+                                       cvn.c_str());
+
+  MakeWalletRequest(GetEscrowUrl(), post_body, observer, kApplicationMimeType);

[Raman Kakilate, 2013/01/08 02:10:28]

just being cautious: are these http get requests logged somewhere on chrome ?
shouldn't these params be post params ?

[ahutter, 2013/01/09 17:31:18]

They are post params but I'm not entirely sure they aren't logged. I'll have to
check with someone else.

[Raman Kakilate, 2013/01/09 22:54:21]

Ah. ok. "&" in the format confused me.  Please check before submission.

+}
+
+
 void WalletClient::GetFullWallet(
     const std::string& instrument_id,
     const std::string& address_id,
@@ -240,6 +262,13 @@ void WalletClient::OnURLFetchComplete(
       }
       break;
     }
+    case ESCROW_SENSITIVE_INFORMATION: {
+      if (!data.empty())
+        observer_->OnEscrowSensitiveInformation(data);
+      else
+        observer_->OnWalletError();
+      break;
+    }
     case GET_FULL_WALLET: {
       if (response_dict.get()) {
         scoped_ptr<FullWallet> full_wallet(