[merge to m54] Prevent interpretating userinfo as url scheme when editing bookmarks

chrome/browser/ui/bookmarks/bookmark_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/bookmarks/bookmark_utils.h"
 
 #include <stddef.h>
 
 #include "base/logging.h"
 #include "build/build_config.h"
@@ skipping 108 matching lines @@
   PrefService* prefs = user_prefs::UserPrefs::Get(browser_context);
   const bool always_show =
       !prefs->GetBoolean(bookmarks::prefs::kShowBookmarkBar);
 
   // The user changed when the bookmark bar is shown, update the preferences.
   prefs->SetBoolean(bookmarks::prefs::kShowBookmarkBar, always_show);
 }
 
 base::string16 FormatBookmarkURLForDisplay(const GURL& url) {
   // Because this gets re-parsed by FixupURL(), it's safe to omit the scheme
-  // and trailing slash, and unescape most characters.  However, it's
+  // and trailing slash, and unescape most characters. However, it's
   // important not to drop any username/password, or unescape anything that
   // changes the URL's meaning.
-  return url_formatter::FormatUrl(
-      url, url_formatter::kFormatUrlOmitAll &
-               ~url_formatter::kFormatUrlOmitUsernamePassword,
-      net::UnescapeRule::SPACES, nullptr, nullptr, nullptr);
+  url_formatter::FormatUrlTypes format_types =
+      url_formatter::kFormatUrlOmitAll &
+      ~url_formatter::kFormatUrlOmitUsernamePassword;
+
+  // If username is present, we must not omit the scheme because FixupURL() will
+  // subsequently interpret the username as a scheme. crbug.com/639126
+  if (url.has_username())
+    format_types &= ~url_formatter::kFormatUrlOmitHTTP;
+
+  return url_formatter::FormatUrl(url, format_types, net::UnescapeRule::SPACES,
+                                  nullptr, nullptr, nullptr);
 }
 
 bool IsAppsShortcutEnabled(Profile* profile) {
   // Legacy supervised users can not have apps installed currently so there's no
   // need to show the apps shortcut.
   if (profile->IsLegacySupervised())
     return false;
 
 #if defined(USE_ASH)
   // Don't show the apps shortcut in ash since the app launcher is enabled.
@@ skipping 161 matching lines @@
 #if defined(OS_WIN)
   return *ui::ResourceBundle::GetSharedInstance().GetImageSkiaNamed(
       IDR_BOOKMARK_BAR_FOLDER_MANAGED);
 #else
   return GetFolderIcon(gfx::VectorIconId::FOLDER_MANAGED, text_color);
 #endif
 }
 #endif
 
 }  // namespace chrome