Switch variations http headers to only be reported over https.

components/variations/net/variations_http_headers.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/variations/net/variations_http_headers.h"
 
 #include <stddef.h>
 
 #include "base/macros.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/strings/string_util.h"
 #include "components/google/core/browser/google_util.h"
 #include "components/variations/variations_http_header_provider.h"
 #include "net/http/http_request_headers.h"
 #include "url/gurl.h"
 
 namespace variations {
 
 namespace {
 
@@ skipping 12 matching lines @@
 };
 
 // Exact hostnames in lowercase to set headers for.
 const char* kHostsToSetHeadersFor[] = {
     "googleweblight.com",
 };
 
 const char kChromeUMAEnabled[] = "X-Chrome-UMA-Enabled";
 const char kClientData[] = "X-Client-Data";
 
+// The result of checking if a URL should have variations headers appended.
+// This enum is used to record UMA histogram values, and should not be
+// reordered.
+enum ShouldAppendHeadersResult {
+  NOT_GOOGLE_DOMAIN,
+  GOOGLE_NOT_HTTPS,
+  SHOULD_APPEND,
+  SHOULD_APPEND_HEADERS_RESULT_SIZE,
+};
+
+// Checks whether headers should be appended to the |url|, based on the domain
+// of |url|, and if it's an http/https spec.

[rkaplow, 2016/12/12 18:25:05]

this method doesn't care about the ssl-ness 

[jwd, 2016/12/12 19:23:08]

Changed code.

+bool ShouldAppendForDomain(const GURL& url) {
+  // IsGoogleDomainUrl checks if the url is valid and is http/https.

[rkaplow, 2016/12/12 18:25:05]

I don't quite get the comment - this doesn't fully check if it's valid since
it's not checking if its HTTPS. Isn't this jut checking if it is a google
domain? maybe rephase?

[jwd, 2016/12/12 19:23:08]

Changed code.

+  if (google_util::IsGoogleDomainUrl(url, google_util::ALLOW_SUBDOMAIN,
+                                     google_util::ALLOW_NON_STANDARD_PORTS)) {
+    return true;
+  }
+
+  if (!url.is_valid() || !url.SchemeIsHTTPOrHTTPS())

[rkaplow, 2016/12/12 18:25:05]

i realize this is just refactored, but it seems odd to me that this occurs after
isgoogeldomainURL. However I checked and isGoogleDomain checks this already,
with:
https://codesearch.chromium.org/chromium/src/components/google/core/browser/g...

(not sure if it's worth changing to that method, up to you).

Another nit on this - seems more intuitive to check before the Google check, but
doesn't make a difference

[jwd, 2016/12/12 19:23:08]

Pulled check out to calling function.

+    return false;
+
+  // Some domains don't have international TLD extensions, so testing for them
+  // is very straight forward.
+  const std::string host = url.host();
+  for (size_t i = 0; i < arraysize(kSuffixesToSetHeadersFor); ++i) {
+    if (base::EndsWith(host, kSuffixesToSetHeadersFor[i],
+                       base::CompareCase::INSENSITIVE_ASCII))
+      return true;
+  }
+  for (size_t i = 0; i < arraysize(kHostsToSetHeadersFor); ++i) {
+    if (base::LowerCaseEqualsASCII(host, kHostsToSetHeadersFor[i]))
+      return true;
+  }
+
+  return google_util::IsYoutubeDomainUrl(url, google_util::ALLOW_SUBDOMAIN,

[rkaplow, 2016/12/12 18:25:05]

this is a minor nit, but seems strange that this is logically away from the
isGoogleDomainURL. I'd prefer this check live up there, and then just a return
false here

[jwd, 2016/12/12 19:23:08]

Done.

+                                         google_util::ALLOW_NON_STANDARD_PORTS);
+}
+
 }  // namespace
 
 void AppendVariationHeaders(const GURL& url,
                             bool incognito,
                             bool uma_enabled,
                             net::HttpRequestHeaders* headers) {
   // Note the criteria for attaching client experiment headers:
   // 1. We only transmit to Google owned domains which can evaluate experiments.
   //    1a. These include hosts which have a standard postfix such as:
   //         *.doubleclick.net or *.googlesyndication.com or
@@ skipping 21 matching lines @@
   std::set<std::string> headers;
   headers.insert(kChromeUMAEnabled);
   headers.insert(kClientData);
   return headers;
 }
 
 namespace internal {
 
 // static
 bool ShouldAppendVariationHeaders(const GURL& url) {
-  if (google_util::IsGoogleDomainUrl(url, google_util::ALLOW_SUBDOMAIN,
-                                     google_util::ALLOW_NON_STANDARD_PORTS)) {
-    return true;
+  const char kShouldAppendResultHistogram[] =
+      "Variations.Headers.ShouldAppendResult";

[rkaplow, 2016/12/12 18:25:05]

I don't love the name of the histogram - it seems a bit indirect. I'd prefer
something that says this is checking the URL. Not sure...
V.H.URLValidationResult? 

[jwd, 2016/12/12 19:23:08]

Done.

+  if (!ShouldAppendForDomain(url)) {
+    UMA_HISTOGRAM_ENUMERATION(kShouldAppendResultHistogram, NOT_GOOGLE_DOMAIN,
+                              SHOULD_APPEND_HEADERS_RESULT_SIZE);
+    return false;
   }
 
-  if (!url.is_valid() || !url.SchemeIsHTTPOrHTTPS())
-    return false;
-
-  // Some domains don't have international TLD extensions, so testing for them
-  // is very straight forward.
-  const std::string host = url.host();
-  for (size_t i = 0; i < arraysize(kSuffixesToSetHeadersFor); ++i) {
-    if (base::EndsWith(host, kSuffixesToSetHeadersFor[i],
-                       base::CompareCase::INSENSITIVE_ASCII))
-      return true;
-  }
-  for (size_t i = 0; i < arraysize(kHostsToSetHeadersFor); ++i) {
-    if (base::LowerCaseEqualsASCII(host, kHostsToSetHeadersFor[i]))
-      return true;
-  }
-
-  return google_util::IsYoutubeDomainUrl(url, google_util::ALLOW_SUBDOMAIN,
-                                         google_util::ALLOW_NON_STANDARD_PORTS);
+  bool isHttps = url.SchemeIs("https");
+  UMA_HISTOGRAM_ENUMERATION(kShouldAppendResultHistogram,
+                            isHttps ? SHOULD_APPEND : GOOGLE_NOT_HTTPS,
+                            SHOULD_APPEND_HEADERS_RESULT_SIZE);
+  return isHttps;
 }
 
 }  // namespace internal
 
 }  // namespace variations