Show Form-Not-Secure warning on page load

chrome/renderer/autofill/password_autofill_agent_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/content/renderer/password_autofill_agent.h"
 
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
 #include "chrome/renderer/autofill/fake_content_password_manager_driver.h"
 #include "chrome/renderer/autofill/fake_password_manager_client.h"
 #include "chrome/renderer/autofill/password_generation_test_utils.h"
 #include "chrome/test/base/chrome_render_view_test.h"
 #include "components/autofill/content/renderer/autofill_agent.h"
 #include "components/autofill/content/renderer/form_autofill_util.h"
 #include "components/autofill/content/renderer/test_password_autofill_agent.h"
 #include "components/autofill/content/renderer/test_password_generation_agent.h"
 #include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/form_data.h"
 #include "components/autofill/core/common/form_field_data.h"
 #include "components/autofill/core/common/password_form.h"
 #include "components/autofill/core/common/password_form_field_prediction_map.h"
 #include "components/password_manager/core/common/password_manager_features.h"
+#include "components/security_state/core/security_state.h"
 #include "content/public/common/associated_interface_provider.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebElement.h"
 #include "third_party/WebKit/public/web/WebFormControlElement.h"
@@ skipping 308 matching lines @@
         mojom::PasswordManagerClient::Name_,
         base::Bind(&PasswordAutofillAgentTest::BindPasswordManagerClient,
                    base::Unretained(this)));
   }
 
   void SetFillOnAccountSelect() {
     scoped_feature_list_.InitAndEnableFeature(
         password_manager::features::kFillOnAccountSelect);
   }
 
+  void SetHttpFormWarning() {
+    scoped_feature_list_.InitAndEnableFeature(
+        security_state::kHttpFormWarningFeature);
+  }
+
   void UpdateOriginForHTML(const std::string& html) {
     std::string origin = "data:text/html;charset=utf-8," + html;
     fill_data_.origin = GURL(origin);
   }
 
   void UpdateUsernameAndPasswordElements() {
     WebDocument document = GetMainFrame()->document();
     WebElement element =
         document.getElementById(WebString::fromUTF8(kUsernameName));
     ASSERT_FALSE(element.isNull());
@@ skipping 112 matching lines @@
                                 autofill::SHOW_ALL));
 
     fake_driver_.reset_show_pw_suggestions();
   }
 
   bool GetCalledShowPasswordSuggestions() {
     base::RunLoop().RunUntilIdle();
     return fake_driver_.called_show_pw_suggestions();
   }
 
+  bool GetCalledShowNotSecureWarning() {
+    base::RunLoop().RunUntilIdle();
+    return fake_driver_.called_show_not_secure_warning();
+  }
+
   void ExpectFormSubmittedWithUsernameAndPasswords(
       const std::string& username_value,
       const std::string& password_value,
       const std::string& new_password_value) {
     base::RunLoop().RunUntilIdle();
     ASSERT_TRUE(fake_driver_.called_password_form_submitted());
     ASSERT_TRUE(static_cast<bool>(fake_driver_.password_form_submitted()));
     const autofill::PasswordForm& form =
         *(fake_driver_.password_form_submitted());
     EXPECT_EQ(ASCIIToUTF16(username_value), form.username_value);
@@ skipping 853 matching lines @@
   // Now simulate a user typing in an unrecognized username and then
   // clicking on the username element. This should also produce a message with
   // all the usernames.
   SimulateUsernameChange("baz");
   static_cast<PageClickListener*>(autofill_agent_)
       ->FormControlElementClicked(username_element_, true);
   CheckSuggestions("baz", true);
   ClearUsernameAndPasswordFields();
 }
 
+// Tests that the Form Not Secure warning appears when a password form
+// is autofilled when the Form Not Secure feature is enabled.
+TEST_F(PasswordAutofillAgentTest, FormNotSecureWarningOnAutofill) {
+  SetHttpFormWarning();

[vabr (Chromium), 2017/01/02 10:15:04]

optional: It might be a good idea to also test that ShowNotSecureWarning is not
called if kHttpFormWarningFeature is not enabled. Such test could have a TODO
linked to the HTTP warning launch bug to delete this test once
kHttpFormWarningFeature is the default behaviour.

On the other hand, launching this UI by accident puts the user in no danger, so
I'm also fine with you not testing for that, as long as it is a conscious
decision.

[estark, 2017/01/03 16:08:36]

Done. Added some additional tests too.

Thanks!

+
+  fill_data_.show_form_not_secure_warning_on_autofill = true;
+
+  // Simulate the browser autofilling a password form.
+  SimulateOnFillPasswordForm(fill_data_);
+  EXPECT_TRUE(GetCalledShowNotSecureWarning());
+}
+
 // Tests that there is an autosuggestion from the password manager when the
 // user clicks on the password field when FillOnAccountSelect is enabled.
 TEST_F(PasswordAutofillAgentTest,
        FillOnAccountSelectOnlyNoCredentialsOnPasswordClick) {
   SetFillOnAccountSelect();
 
   // Simulate the browser sending back the login info.
   SimulateOnShowInitialPasswordAccountSuggestions(fill_data_);
 
   // Clear the text fields to start fresh.
@@ skipping 1092 matching lines @@
   SimulateElementClick("confirmpassword");
   EXPECT_FALSE(GetCalledShowPasswordSuggestions());
 
   // But when the user clicks on the autofilled password field again it should
   // still produce a suggestion dropdown.
   SimulateElementClick("password");
   CheckSuggestions("", false);
 }
 
 }  // namespace autofill