Encrypt password values in LoginDatabase on Mac.

chrome/browser/password_manager/password_store_mac_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/password_manager/password_store_mac.h"
 
 #include "base/basictypes.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/scoped_observer.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/waitable_event.h"
+#include "base/test/histogram_tester.h"
 #include "base/thread_task_runner_handle.h"
 #include "chrome/browser/password_manager/password_store_mac_internal.h"
 #include "chrome/common/chrome_paths.h"
+#include "components/os_crypt/os_crypt.h"
 #include "components/password_manager/core/browser/login_database.h"
 #include "components/password_manager/core/browser/password_manager_test_utils.h"
 #include "components/password_manager/core/browser/password_store_consumer.h"
 #include "content/public/test/test_browser_thread.h"
 #include "crypto/mock_apple_keychain.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using autofill::PasswordForm;
 using base::ASCIIToUTF16;
@@ skipping 1171 matching lines @@
 
 #pragma mark -
 
 class PasswordStoreMacTest : public testing::Test {
  public:
   PasswordStoreMacTest() : ui_thread_(BrowserThread::UI, &message_loop_) {}
 
   void SetUp() override {
     ASSERT_TRUE(db_dir_.CreateUniqueTempDir());
 
+    // Ensure that LoginDatabase will use the mock keychain if it needs to
+    // encrypt/decrypt a password.
+    OSCrypt::UseMockKeychain(true);
     scoped_ptr<password_manager::LoginDatabase> login_db(
         new password_manager::LoginDatabase(test_login_db_file_path()));
     CreateAndInitPasswordStore(login_db.Pass());
     // Make sure deferred initialization is performed before some tests start
     // accessing the |login_db| directly.
     FinishAsyncProcessing();
   }
 
-  void TearDown() override { ClosePasswordStore(); }
+  void TearDown() override {
+    ClosePasswordStore();
+    // Whatever a test did, PasswordStoreMac stores only empty password values
+    // in LoginDatabase. The empty valus do not require encryption and therefore
+    // OSCrypt shouldn't call the Keychain. The histogram doesn't cover the
+    // internet passwords.
+    EXPECT_FALSE(histogram_tester_.GetHistogramSamplesSinceCreation(
+        "OSX.Keychain.Access"));
+  }
 
   void CreateAndInitPasswordStore(
       scoped_ptr<password_manager::LoginDatabase> login_db) {
     store_ = new TestPasswordStoreMac(
         base::ThreadTaskRunnerHandle::Get(),
         base::ThreadTaskRunnerHandle::Get(),
         make_scoped_ptr<AppleKeychain>(new MockAppleKeychain), login_db.Pass());
     ASSERT_TRUE(store_->Init(syncer::SyncableService::StartSyncFlare()));
   }
 
@@ skipping 80 matching lines @@
   }
 
   TestPasswordStoreMac* store() { return store_.get(); }
 
  protected:
   base::MessageLoopForUI message_loop_;
   content::TestBrowserThread ui_thread_;
 
   base::ScopedTempDir db_dir_;
   scoped_refptr<TestPasswordStoreMac> store_;
+  base::HistogramTester histogram_tester_;
 };
 
 TEST_F(PasswordStoreMacTest, TestStoreUpdate) {
   // Insert a password into both the database and the keychain.
   // This is done manually, rather than through store_->AddLogin, because the
   // Mock Keychain isn't smart enough to be able to support update generically,
   // so some.domain.com triggers special handling to test it that make inserting
   // fail.
   PasswordFormData joint_data = {
     PasswordForm::SCHEME_HTML, "http://some.domain.com/",
@@ skipping 493 matching lines @@
 // Verify that federated credentials can be stored, retrieved and deleted.
 TEST_F(PasswordStoreMacTest, StoringAndRetrievingFederatedCredentials) {
   PasswordForm form;
   form.signon_realm = "android://7x7IDboo8u9YKraUsbmVkuf1@net.rateflix.app/";
   form.federation_url = GURL(password_manager::kTestingFederationUrlSpec);
   form.username_value = base::UTF8ToUTF16("randomusername");
   form.password_value = base::UTF8ToUTF16("");  // No password.
 
   VerifyCredentialLifecycle(form);
 }