CREDENTIAL: Teach the 'PasswordCredential(HTMLFormElement)' constructor about URLSearchParams

third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp

Index: third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
diff --git a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
index 743bb10745e0b6960d88be09327e989c75b7be36..1eb135cf0fc74374aaebb9cc59d37eda9fc92f31 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
@@ -81,11 +81,24 @@ PasswordCredential* PasswordCredential::create(HTMLFormElement* form, ExceptionS
     ASSERT(credential);
 
     // After creating the Credential, populate its 'additionalData', 'idName', and 'passwordName' attributes.
-    FormDataOrURLSearchParams additionalData;
-    additionalData.setFormData(formData);
-    credential->setAdditionalData(additionalData);
+    // If the form's 'enctype' is anything other than multipart, generate a URLSearchParams using the
+    // data in |formData|.
     credential->setIdName(idName);
     credential->setPasswordName(passwordName);
+
+    FormDataOrURLSearchParams additionalData;
+    if (equalIgnoringCase(form->fastGetAttribute(HTMLNames::enctypeAttr), "multipart/form-data")) {

[philipj_slow, 2016/03/29 06:07:34]

The spec doesn't say "ASCII case-insensitive" here. The IDL attribute is
reflected and normalizes case in the getter, but your spec links to the content
attribute.

Maybe you should use
https://html.spec.whatwg.org/multipage/forms.html#concept-fs-enctype in the
spec, and FormSubmission::encodingType() here? If that's not possible
implementation-wise, then just this with a comment that it's really supposed to
be checking the state would work I think.

[Mike West, 2016/03/31 08:53:17]

Well, the spec says that the content attribute is an enumerated attribute, which
already does case-folding and etc. `FormSubmission::encodingType()` is certainly
what we want, and I just missed that it's exposed as
`HTMLFormElement::enctype()`.
This seems reasonable. I've updated the spec in
https://github.com/w3c/webappsec-credential-management/commit/736f64a1a09dbbb....

+        additionalData.setFormData(formData);
+    } else {
+        URLSearchParams* params = URLSearchParams::create(URLSearchParamsInit());
+        for (const FormData::Entry* entry : formData->entries()) {
+            if (entry->isString())
+                params->append(entry->name().data(), entry->value().data());
+        }
+        additionalData.setURLSearchParams(params);
+    }
+
+    credential->setAdditionalData(additionalData);
     return credential;
 }