signin: force web signin flow initiated visits to accounts.google.com to their own process.

chrome/browser/ui/sync/one_click_signin_helper.cc

Index: chrome/browser/ui/sync/one_click_signin_helper.cc
diff --git a/chrome/browser/ui/sync/one_click_signin_helper.cc b/chrome/browser/ui/sync/one_click_signin_helper.cc
index 7a898bad89ee47a1e4956eb38230e2c40297c99f..414798cc9cd9fd226fe8d414ad3540d384b5afbf 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper.cc
@@ -55,6 +55,7 @@
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_view.h"
 #include "content/public/common/frame_navigate_params.h"
@@ -553,6 +554,11 @@ bool OneClickSigninHelper::CanOffer(content::WebContents* web_contents,
     if (!manager)
       return false;
 
+    if (!manager->IsSigninProcess(

[Charlie Reis, 2013/02/28 19:19:46]

Can you add a comment here, to the effect of "We only allow the dedicated
sign-in process to sign the user into Chrome, because it doesn't load any
untrusted pages."

[tim (not reviewing), 2013/03/01 01:53:57]

Done.

+        web_contents->GetRenderProcessHost()->GetID())) {
+      return false;
+    }
+
     // If the signin manager already has an authenticated name, then this is a
     // re-auth scenario.  Make sure the email just signed in corresponds to the
     // the one sign in manager expects.