CREDENTIAL: Teach the 'PasswordCredential(HTMLFormElement)' constructor about URLSearchParams

third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/credentialmanager/PasswordCredential.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/HTMLNames.h"
 #include "core/dom/ExecutionContext.h"
@@ skipping 63 matching lines @@
         }
     }
 
     // Create a PasswordCredential using the data gathered above.
     PasswordCredential* credential = PasswordCredential::create(data, exceptionState);
     if (exceptionState.hadException())
         return nullptr;
     ASSERT(credential);
 
     // After creating the Credential, populate its 'additionalData', 'idName', and 'passwordName' attributes.
-    FormDataOrURLSearchParams additionalData;
-    additionalData.setFormData(formData);
-    credential->setAdditionalData(additionalData);
+    // If the form's 'enctype' is anything other than multipart, generate a URLSearchParams using the
+    // data in |formData|.
     credential->setIdName(idName);
     credential->setPasswordName(passwordName);
+
+    FormDataOrURLSearchParams additionalData;
+    if (equalIgnoringCase(form->fastGetAttribute(HTMLNames::enctypeAttr), "multipart/form-data")) {

[philipj_slow, 2016/03/29 06:07:34]

The spec doesn't say "ASCII case-insensitive" here. The IDL attribute is
reflected and normalizes case in the getter, but your spec links to the content
attribute.

Maybe you should use
https://html.spec.whatwg.org/multipage/forms.html#concept-fs-enctype in the
spec, and FormSubmission::encodingType() here? If that's not possible
implementation-wise, then just this with a comment that it's really supposed to
be checking the state would work I think.

[Mike West, 2016/03/31 08:53:17]

Well, the spec says that the content attribute is an enumerated attribute, which
already does case-folding and etc. `FormSubmission::encodingType()` is certainly
what we want, and I just missed that it's exposed as
`HTMLFormElement::enctype()`.
This seems reasonable. I've updated the spec in
https://github.com/w3c/webappsec-credential-management/commit/736f64a1a09dbbb....

+        additionalData.setFormData(formData);
+    } else {
+        URLSearchParams* params = URLSearchParams::create(URLSearchParamsInit());
+        for (const FormData::Entry* entry : formData->entries()) {
+            if (entry->isString())
+                params->append(entry->name().data(), entry->value().data());
+        }
+        additionalData.setURLSearchParams(params);
+    }
+
+    credential->setAdditionalData(additionalData);
     return credential;
 }
 
 PasswordCredential::PasswordCredential(WebPasswordCredential* webPasswordCredential)
     : Credential(webPasswordCredential->getPlatformCredential())
     , m_idName("username")
     , m_passwordName("password")
 {
 }
 
@@ skipping 51 matching lines @@
     return static_cast<PlatformPasswordCredential*>(m_platformCredential.get())->password();
 }
 
 DEFINE_TRACE(PasswordCredential)
 {
     Credential::trace(visitor);
     visitor->trace(m_additionalData);
 }
 
 } // namespace blink