Add security feature to ProvisionalSavePassword

components/password_manager/core/browser/password_manager.h

Index: components/password_manager/core/browser/password_manager.h
diff --git a/components/password_manager/core/browser/password_manager.h b/components/password_manager/core/browser/password_manager.h
index 467f6a886550e9321030a52d58c749ff60a3a927..2430288c1af692f6f20c39d0a674ecde1618bb39 100644
--- a/components/password_manager/core/browser/password_manager.h
+++ b/components/password_manager/core/browser/password_manager.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "base/strings/string16.h"
@@ -183,6 +184,10 @@ class PasswordManager : public LoginModel {
 #endif
 
  private:
+  FRIEND_TEST_ALL_PREFIXES(
+      PasswordManagerTest,
+      ShouldBlockPasswordForSameOriginButDifferentSchemeTest);
+
   enum ProvisionalSaveFailure {
     SAVING_DISABLED,
     EMPTY_PASSWORD,
@@ -210,6 +215,13 @@ class PasswordManager : public LoginModel {
   // non-blacklisted.
   bool CanProvisionalManagerSave();
 
+  // Returns true if there already exists a provisionally saved password form
+  // from the same domain as |form|, but with a different and secure scheme.
+  // This prevents users from unintentionally storing credentials, see

[vasilii, 2017/01/12 14:59:21]

storing which credentials?

[jdoerrie, 2017/01/12 17:40:58]

Changed the description to be hopefully more clear.

+  // http://crbug.com/571580 for details.
+  bool ShouldBlockPasswordForSameOriginButDifferentScheme(
+      const autofill::PasswordForm& form) const;
+
   // Returns true if the user needs to be prompted before a password can be
   // saved (instead of automatically saving
   // the password), based on inspecting the state of