Encrypt password values in LoginDatabase on Mac.

components/password_manager/core/browser/login_database.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LOGIN_DATABASE_H_
 #define COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LOGIN_DATABASE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 93 matching lines @@
 
   // Deletes the login database file on disk, and creates a new, empty database.
   // This can be used after migrating passwords to some other store, to ensure
   // that SQLite doesn't leave fragments of passwords in the database file.
   // Returns true on success; otherwise, whether the file was deleted and
   // whether further use of this login database will succeed is unspecified.
   bool DeleteAndRecreateDatabaseFile();
 
   StatisticsTable& stats_table() { return stats_table_; }
 
+  // If set to 'true', then the password values are cleared before encrypting

[vabr (Chromium), 2015/06/18 13:39:09]

This comment should go to the variable declaration. Not everybody looking at the
decl. will think about finding the setter, but everybody looking at the setter
can look up the declaration.

[vasilii, 2015/06/18 14:28:13]

Done.

+  // and storing in the database. At the same time AddLogin/UpdateLogin return
+  // PasswordStoreChangeList containing the real password.
+  void set_clear_password_values(bool val) { clear_password_values_ = val; }
+
  private:
   // Result values for encryption/decryption actions.
   enum EncryptionResult {
     // Success.
     ENCRYPTION_RESULT_SUCCESS,
     // Failure for a specific item (e.g., the encrypted value was manually
     // moved from another machine, and can't be decrypted on this machine).
     // This is presumed to be a permanent failure.
     ENCRYPTION_RESULT_ITEM_FAILURE,
     // A service-level failure (e.g., on a platform using a keyring, the keyring
@@ skipping 38 matching lines @@
   // |psl_match| is not null, filters out all results but thos PSL-matching
   // |*psl_match|. On success returns true.
   static bool StatementToForms(sql::Statement* statement,
                                const autofill::PasswordForm* psl_match,
                                ScopedVector<autofill::PasswordForm>* forms);
 
   base::FilePath db_path_;
   mutable sql::Connection db_;
   sql::MetaTable meta_table_;
   StatisticsTable stats_table_;
+  bool clear_password_values_;

[vabr (Chromium), 2015/06/18 13:39:09]

Also, is this just some temporary measure until we stop using the keychain? If
so, it should be marked as such, including the link to http://crbug.com/466638.

[vasilii, 2015/06/18 14:28:13]

Done.

 
   DISALLOW_COPY_AND_ASSIGN(LoginDatabase);
 };
 
 }  // namespace password_manager
 
 #endif  // COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LOGIN_DATABASE_H_