signin: force web signin flow initiated visits to accounts.google.com to their own process.

chrome/browser/ui/sync/one_click_signin_helper_unittest.cc

Index: chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
diff --git a/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc b/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
index 0d889188520644fa00d5d47b59e89295136ed41d..590d2f0bd92698d7b242b657845e96bde109044b 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
@@ -231,6 +231,10 @@ class OneClickSigninHelperTest : public content::RenderViewHostTestHarness {
   // the given account.
   void CreateSigninManager(bool use_incognito, const std::string& username);
 
+  // Set the ID of the signin process that the test will assume to be the
+  // only process allowed to sign the user in to Chrome.
+  void SetTrustedSigninProcessID(int id);
+
   void AddEmailToOneClickRejectedList(const std::string& email);
   void EnableOneClick(bool enable);
   void AllowSigninCookies(bool enable);
@@ -245,12 +249,18 @@ class OneClickSigninHelperTest : public content::RenderViewHostTestHarness {
   // Members to fake that we are on the UI thread.
   content::TestBrowserThread ui_thread_;
 
+  // The ID of the signin process the test will assume to be trusted.
+  // By default, set to the test RenderProcessHost's process ID, but
+  // overridden by SetTrustedSigninProcessID.
+  int trusted_signin_process_id_;
+
   DISALLOW_COPY_AND_ASSIGN(OneClickSigninHelperTest);
 };
 
 OneClickSigninHelperTest::OneClickSigninHelperTest()
     : profile_(NULL),
-      ui_thread_(content::BrowserThread::UI, &message_loop_) {
+      ui_thread_(content::BrowserThread::UI, &message_loop_),
+      trusted_signin_process_id_(-1) {
 }
 
 void OneClickSigninHelperTest::SetUp() {
@@ -258,6 +268,7 @@ void OneClickSigninHelperTest::SetUp() {
   profile_ = new TestingProfile();
   browser_context_.reset(profile_);
   content::RenderViewHostTestHarness::SetUp();
+  SetTrustedSigninProcessID(process()->GetID());
 }
 
 void OneClickSigninHelperTest::TearDown() {
@@ -265,6 +276,10 @@ void OneClickSigninHelperTest::TearDown() {
   content::RenderViewHostTestHarness::TearDown();
 }
 
+void OneClickSigninHelperTest::SetTrustedSigninProcessID(int id) {
+  trusted_signin_process_id_ = id;
+}
+
 void OneClickSigninHelperTest::CreateSigninManager(
     bool use_incognito,
     const std::string& username) {
@@ -272,8 +287,10 @@ void OneClickSigninHelperTest::CreateSigninManager(
   signin_manager_ = static_cast<SigninManagerMock*>(
       SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
           profile_, BuildSigninManagerMock));
-
+  if (signin_manager_)
+    signin_manager_->SetSigninProcess(trusted_signin_process_id_);
   if (!username.empty()) {
+    ASSERT_TRUE(signin_manager_);
     signin_manager_->StartSignIn(username, std::string(), std::string(),
                                 std::string());
   }
@@ -571,6 +588,22 @@ TEST_F(OneClickSigninHelperTest, CanOfferNoSigninCookies) {
   EXPECT_EQ("", error_message);
 }
 
+TEST_F(OneClickSigninHelperTest, CanOfferUntrustedProcess) {
+  content::MockRenderProcessHost trusted(browser_context_.get());
+  ASSERT_NE(trusted.GetID(), process()->GetID());
+  // Make sure the RenderProcessHost used by the test is untrusted.
+  SetTrustedSigninProcessID(trusted.GetID());
+  CreateSigninManager(false, "");
+
+  EXPECT_CALL(*signin_manager_, IsAllowedUsername(_)).
+        WillRepeatedly(Return(true));
+
+  EnableOneClick(true);
+  EXPECT_FALSE(OneClickSigninHelper::CanOffer(
+      web_contents(), OneClickSigninHelper::CAN_OFFER_FOR_ALL,
+      "user@gmail.com", NULL));
+}
+
 TEST_F(OneClickSigninHelperTest, CanOfferDisabledByPolicy) {
   CreateSigninManager(false, "");