Do not install WebAPKs with web manifests with invalid URL components

chrome/browser/installable/installable_manager_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/installable/installable_manager.h"
 
 #include "base/strings/utf_string_conversions.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebDisplayMode.h"
 
@@ skipping 17 matching lines @@
     icon.type = ToNullableUTF16("image/png");
     icon.sizes.push_back(gfx::Size(144, 144));
     manifest.icons.push_back(icon);
 
     return manifest;
   }
 
   bool IsManifestValid(const content::Manifest& manifest) {
     // Explicitly reset the error code before running the method.
     manager_->set_installable_error(NO_ERROR_DETECTED);
-    return manager_->IsManifestValidForWebApp(manifest);
+    return manager_->IsManifestValidForWebApp(GURL(), manifest);
   }
 
   InstallableStatusCode GetErrorCode() {
     return manager_->installable_error();
   }
 
  private:
   std::unique_ptr<InstallableManager> manager_;
 };
 
@@ skipping 48 matching lines @@
 
   manifest.start_url = GURL();
   EXPECT_FALSE(IsManifestValid(manifest));
   EXPECT_EQ(START_URL_NOT_VALID, GetErrorCode());
 
   manifest.start_url = GURL("/");
   EXPECT_FALSE(IsManifestValid(manifest));
   EXPECT_EQ(START_URL_NOT_VALID, GetErrorCode());
 }
 
+TEST_F(InstallableManagerUnitTest, ManifestRequiresPasswordFreeUrls) {
+  content::Manifest manifest = GetValidManifest();
+  manifest.start_url = GURL("http://answer:42@life/universe/and/everything");
+  EXPECT_FALSE(IsManifestValid(manifest));
+  EXPECT_EQ(URL_USERNAME_AND_PASSWORD_NOT_SUPPORTED, GetErrorCode());
+
+  manifest = GetValidManifest();
+  manifest.icons[0].src = GURL("http://question:unknown@life/universe/and/everything");
+  EXPECT_FALSE(IsManifestValid(manifest));
+  EXPECT_EQ(URL_USERNAME_AND_PASSWORD_NOT_SUPPORTED, GetErrorCode());
+}
+
 TEST_F(InstallableManagerUnitTest, ManifestRequiresImagePNG) {
   content::Manifest manifest = GetValidManifest();
 
   manifest.icons[0].type = ToNullableUTF16("image/gif");
   EXPECT_FALSE(IsManifestValid(manifest));
   EXPECT_EQ(MANIFEST_MISSING_SUITABLE_ICON, GetErrorCode());
 
   manifest.icons[0].type = base::NullableString16();
   EXPECT_FALSE(IsManifestValid(manifest));
   EXPECT_EQ(MANIFEST_MISSING_SUITABLE_ICON, GetErrorCode());
@@ skipping 63 matching lines @@
   EXPECT_EQ(MANIFEST_DISPLAY_NOT_SUPPORTED, GetErrorCode());
 
   manifest.display = blink::WebDisplayModeStandalone;
   EXPECT_TRUE(IsManifestValid(manifest));
   EXPECT_EQ(NO_ERROR_DETECTED, GetErrorCode());
 
   manifest.display = blink::WebDisplayModeFullscreen;
   EXPECT_TRUE(IsManifestValid(manifest));
   EXPECT_EQ(NO_ERROR_DETECTED, GetErrorCode());
 }