Stop trusting the sign-in process if it manages to navigate to another URL.

chrome/browser/ui/sync/one_click_signin_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/sync/one_click_signin_helper.h"
 
 #include <algorithm>
 #include <functional>
 #include <utility>
 #include <vector>
@@ skipping 973 matching lines @@
 
   if (!IsValidGaiaSigninRedirectOrResponseURL(url) &&
       continue_url_.is_valid() &&
       url.ReplaceComponents(replacements) !=
           continue_url_.ReplaceComponents(replacements)) {
     if (++untrusted_navigations_since_signin_visit_ > kMaxNavigationsSince)
       CleanTransientState();
   }
 }
 
+void OneClickSigninHelper::DidNavigateMainFrame(
+    const content::LoadCommittedDetails& details,
+    const content::FrameNavigateParams& params) {
+  // If we navigate to a non-sign-in URL, make sure that the renderer process
+  // is no longer considered the trusted sign-in process.
+  if (!SigninManager::IsWebBasedSigninFlowURL(params.url)) {
+    Profile* profile =
+        Profile::FromBrowserContext(web_contents()->GetBrowserContext());
+    SigninManager* manager = profile ?
+        SigninManagerFactory::GetForProfile(profile) : NULL;
+    if (manager)
+      manager->ClearSigninProcess();
+  }
+}
+
 void OneClickSigninHelper::DidStopLoading(
     content::RenderViewHost* render_view_host) {
   // If the user left the sign in process, clear all members.
   // TODO(rogerta): might need to allow some youtube URLs.
   content::WebContents* contents = web_contents();
   const GURL url = contents->GetURL();
   Profile* profile =
       Profile::FromBrowserContext(contents->GetBrowserContext());
   VLOG(1) << "OneClickSigninHelper::DidStopLoading: url=" << url.spec();
 
@@ skipping 239 matching lines @@
     contents->GetController().LoadURL(redirect_url_,
                                       content::Referrer(),
                                       content::PAGE_TRANSITION_AUTO_TOPLEVEL,
                                       std::string());
   }
 
   // Clear the redirect URL.
   redirect_url_ = GURL();
   sync_service->RemoveObserver(this);
 }