Do not install WebAPKs with web manifests with invalid URL components

chrome/browser/installable/installable_manager_unittest.cc

Index: chrome/browser/installable/installable_manager_unittest.cc
diff --git a/chrome/browser/installable/installable_manager_unittest.cc b/chrome/browser/installable/installable_manager_unittest.cc
index 0913920fc36604aeaf4194f150e8e8f682b24c74..78680f3777e0667ac356a8dbe12a1dda2569cea3 100644
--- a/chrome/browser/installable/installable_manager_unittest.cc
+++ b/chrome/browser/installable/installable_manager_unittest.cc
@@ -35,7 +35,7 @@ class InstallableManagerUnitTest : public testing::Test {
   bool IsManifestValid(const content::Manifest& manifest) {
     // Explicitly reset the error code before running the method.
     manager_->set_installable_error(NO_ERROR_DETECTED);
-    return manager_->IsManifestValidForWebApp(manifest);
+    return manager_->IsManifestValidForWebApp(GURL(), manifest);
   }
 
   InstallableStatusCode GetErrorCode() {
@@ -104,6 +104,18 @@ TEST_F(InstallableManagerUnitTest, ManifestRequiresValidStartURL) {
   EXPECT_EQ(START_URL_NOT_VALID, GetErrorCode());
 }
 
+TEST_F(InstallableManagerUnitTest, ManifestRequiresPasswordFreeUrls) {
+  content::Manifest manifest = GetValidManifest();
+  manifest.start_url = GURL("http://answer:42@life/universe/and/everything");
+  EXPECT_FALSE(IsManifestValid(manifest));
+  EXPECT_EQ(URL_USERNAME_AND_PASSWORD_NOT_SUPPORTED, GetErrorCode());
+
+  manifest = GetValidManifest();
+  manifest.icons[0].src = GURL("http://question:unknown@life/universe/and/everything");
+  EXPECT_FALSE(IsManifestValid(manifest));
+  EXPECT_EQ(URL_USERNAME_AND_PASSWORD_NOT_SUPPORTED, GetErrorCode());
+}
+
 TEST_F(InstallableManagerUnitTest, ManifestRequiresImagePNG) {
   content::Manifest manifest = GetValidManifest();