Password manager internals page: Introduce logger in renderer

components/autofill/content/common/autofill_messages.h

Index: components/autofill/content/common/autofill_messages.h
diff --git a/components/autofill/content/common/autofill_messages.h b/components/autofill/content/common/autofill_messages.h
index 9b01b5d2a61aa6c6da003472065b0c4e092c4d6a..0f442028d92bec0ce315c9fffcef35d9eeb3b14a 100644
--- a/components/autofill/content/common/autofill_messages.h
+++ b/components/autofill/content/common/autofill_messages.h
@@ -185,6 +185,10 @@ IPC_MESSAGE_ROUTED1(AutofillHostMsg_PasswordFormsRendered,
 IPC_MESSAGE_ROUTED1(AutofillHostMsg_PasswordFormSubmitted,
                     autofill::PasswordForm /* form */)
 
+// Notification that logs during saving the password have been gathered.

[Tom Sepez, 2014/04/10 19:16:42]

We'd be a lot happier if the log wasn't a free-form string; there's really no
way to audit what information might be leaked in that case.  From the design
doc, it looks like you are recording an URL plus a set of events which might
have happened to it.  If so, it would be much better to pass the URL, plus some
enums/flags to describe what's going on.

[Tom Sepez, 2014/04/10 19:20:57]

nit: I'm having a hard time reading that sentence.

[Ilya Sherman, 2014/04/10 19:32:15]

There are actually methods that build these strings from more structured data,
sanitizing along the way: [
https://code.google.com/p/chromium/codesearch#chromium/src/components/autofil...
].  Those methods internally sanitize the data, then call SendLog().  Does that
address your concern, or do you think it's important to perform the sanitization
at the IPC layer?

[vabr (Chromium), 2014/04/10 19:37:05]

Does it help, that the URLs are being scrubbed to port and host?
(https://code.google.com/p/chromium/codesearch#chromium/src/components/autofil...)
This ScrubURL is used on everything which can be a URL, free form strings logged
through the logger are compile-time constants.

If it does not help, I can change the code to send structured messages + a
compile-time known set of strings.

[vabr (Chromium), 2014/04/10 19:37:05]

Would
"Sends the collected log to browser for displaying to the user"
be better?

+IPC_MESSAGE_ROUTED1(AutofillHostMsg_RecordSavePasswordProgress,
+                    std::string /* log */)
+
 // Notification that a form has been submitted.  The user hit the button.
 IPC_MESSAGE_ROUTED2(AutofillHostMsg_FormSubmitted,
                     autofill::FormData /* form */,