Revert of Filter out credentials with non-matching schemes

Revert of Filter out credentials with non-matching schemes (patchset #1 id:1 of https://codereview.chromium.org/2298733002/ )

Reason for revert:
Patch is crashing tests on windows bots.

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%281%29/builds/52229

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%281%29/builds/52229/steps/browser_tests%20on%20Windows-7-SP1/logs/AutofillEditAddressWebUITest.testFieldValuesSaved

Original issue's description:
> Filter out credentials with non-matching schemes
>
> PasswordFormManager::ProcessMatches currently happily accepts credentials from
> PasswordStore with a different PasswordForm::Scheme than the observed form has.
> However, it still has a DCHECK against it later (in the Autofill* methods), so
> it is clearly not expecting these, rather than mixing the schemes being by
> design.
>
> And it should not be by design. Especially, if the saved credential is a
> non-HTML one, and should be filled in a HTML form. Mixing them makes the
> non-HTML credential vulnerable against (injected attacker's) JavaScript
> accessing them.
>
> This CL filters out credentials with non-matching scheme from the batch coming
> from the PasswordStore. Given the absence of DCHECKs in release builds, this
> actually changes the behaviour for Chrome users, but the change is a desired
> one.
>
> BUG=640897
>
> Committed: https://crrev.com/da597b2f777ea4ac768164bee01f39a90fba3c65
> Cr-Commit-Position: refs/heads/master@{#415622}

TBR=mkwst@chromium.org,dvadym@chromium.org,vabr@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=640897
Committed: https://crrev.com/53105f2efbdccc7714b8bba189e628b0f87f7fba
Cr-Commit-Position: refs/heads/master@{#415648}

[fgorski, 2016-08-31 16:17:05]

The CQ bit was checked by fgorski@chromium.org

[fgorski, 2016-08-31 16:17:05]

Created Revert of Filter out credentials with non-matching schemes

[commit-bot: I haz the power, 2016-08-31 16:17:33]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-31 16:18:56]

Description was changed from

==========
Revert of Filter out credentials with non-matching schemes (patchset #1 id:1 of
https://codereview.chromium.org/2298733002/ )

Reason for revert:
Patch is crashing tests on windows bots. 

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

Original issue's description:
> Filter out credentials with non-matching schemes
> 
> PasswordFormManager::ProcessMatches currently happily accepts credentials from
> PasswordStore with a different PasswordForm::Scheme than the observed form
has.
> However, it still has a DCHECK against it later (in the Autofill* methods), so
> it is clearly not expecting these, rather than mixing the schemes being by
> design.
> 
> And it should not be by design. Especially, if the saved credential is a
> non-HTML one, and should be filled in a HTML form. Mixing them makes the
> non-HTML credential vulnerable against (injected attacker's) JavaScript
> accessing them.
> 
> This CL filters out credentials with non-matching scheme from the batch coming
> from the PasswordStore. Given the absence of DCHECKs in release builds, this
> actually changes the behaviour for Chrome users, but the change is a desired
> one.
> 
> BUG=640897
> 
> Committed: https://crrev.com/da597b2f777ea4ac768164bee01f39a90fba3c65
> Cr-Commit-Position: refs/heads/master@{#415622}

TBR=mkwst@chromium.org,dvadym@chromium.org,vabr@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=640897
==========

to

==========
Revert of Filter out credentials with non-matching schemes (patchset #1 id:1 of
https://codereview.chromium.org/2298733002/ )

Reason for revert:
Patch is crashing tests on windows bots. 

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

Original issue's description:
> Filter out credentials with non-matching schemes
> 
> PasswordFormManager::ProcessMatches currently happily accepts credentials from
> PasswordStore with a different PasswordForm::Scheme than the observed form
has.
> However, it still has a DCHECK against it later (in the Autofill* methods), so
> it is clearly not expecting these, rather than mixing the schemes being by
> design.
> 
> And it should not be by design. Especially, if the saved credential is a
> non-HTML one, and should be filled in a HTML form. Mixing them makes the
> non-HTML credential vulnerable against (injected attacker's) JavaScript
> accessing them.
> 
> This CL filters out credentials with non-matching scheme from the batch coming
> from the PasswordStore. Given the absence of DCHECKs in release builds, this
> actually changes the behaviour for Chrome users, but the change is a desired
> one.
> 
> BUG=640897
> 
> Committed: https://crrev.com/da597b2f777ea4ac768164bee01f39a90fba3c65
> Cr-Commit-Position: refs/heads/master@{#415622}

TBR=mkwst@chromium.org,dvadym@chromium.org,vabr@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=640897
==========

[commit-bot: I haz the power, 2016-08-31 16:18:57]

Committed patchset #1 (id:1)

[vabr (Chromium), 2016-08-31 16:20:06]

lgtm

[commit-bot: I haz the power, 2016-08-31 16:22:18]

Description was changed from

==========
Revert of Filter out credentials with non-matching schemes (patchset #1 id:1 of
https://codereview.chromium.org/2298733002/ )

Reason for revert:
Patch is crashing tests on windows bots. 

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

Original issue's description:
> Filter out credentials with non-matching schemes
> 
> PasswordFormManager::ProcessMatches currently happily accepts credentials from
> PasswordStore with a different PasswordForm::Scheme than the observed form
has.
> However, it still has a DCHECK against it later (in the Autofill* methods), so
> it is clearly not expecting these, rather than mixing the schemes being by
> design.
> 
> And it should not be by design. Especially, if the saved credential is a
> non-HTML one, and should be filled in a HTML form. Mixing them makes the
> non-HTML credential vulnerable against (injected attacker's) JavaScript
> accessing them.
> 
> This CL filters out credentials with non-matching scheme from the batch coming
> from the PasswordStore. Given the absence of DCHECKs in release builds, this
> actually changes the behaviour for Chrome users, but the change is a desired
> one.
> 
> BUG=640897
> 
> Committed: https://crrev.com/da597b2f777ea4ac768164bee01f39a90fba3c65
> Cr-Commit-Position: refs/heads/master@{#415622}

TBR=mkwst@chromium.org,dvadym@chromium.org,vabr@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=640897
==========

to

==========
Revert of Filter out credentials with non-matching schemes (patchset #1 id:1 of
https://codereview.chromium.org/2298733002/ )

Reason for revert:
Patch is crashing tests on windows bots.

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

https://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%2...

Original issue's description:
> Filter out credentials with non-matching schemes
>
> PasswordFormManager::ProcessMatches currently happily accepts credentials from
> PasswordStore with a different PasswordForm::Scheme than the observed form
has.
> However, it still has a DCHECK against it later (in the Autofill* methods), so
> it is clearly not expecting these, rather than mixing the schemes being by
> design.
>
> And it should not be by design. Especially, if the saved credential is a
> non-HTML one, and should be filled in a HTML form. Mixing them makes the
> non-HTML credential vulnerable against (injected attacker's) JavaScript
> accessing them.
>
> This CL filters out credentials with non-matching scheme from the batch coming
> from the PasswordStore. Given the absence of DCHECKs in release builds, this
> actually changes the behaviour for Chrome users, but the change is a desired
> one.
>
> BUG=640897
>
> Committed: https://crrev.com/da597b2f777ea4ac768164bee01f39a90fba3c65
> Cr-Commit-Position: refs/heads/master@{#415622}

TBR=mkwst@chromium.org,dvadym@chromium.org,vabr@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=640897

Committed: https://crrev.com/53105f2efbdccc7714b8bba189e628b0f87f7fba
Cr-Commit-Position: refs/heads/master@{#415648}
==========

[commit-bot: I haz the power, 2016-08-31 16:22:19]

Patchset 1 (id:??) landed as
https://crrev.com/53105f2efbdccc7714b8bba189e628b0f87f7fba
Cr-Commit-Position: refs/heads/master@{#415648}