Show FormNotSecure warnings on sensitive inputs in non-secure contexts

components/autofill/core/browser/autofill_manager_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/core/browser/autofill_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <memory>
@@ skipping 677 matching lines @@
     suggestions_ = suggestions;
   }
 
   void CheckSuggestions(int expected_page_id,
                         size_t expected_num_suggestions,
                         const Suggestion expected_suggestions[]) {
     // Ensure that these results are from the most recent query.
     EXPECT_TRUE(on_suggestions_returned_seen_);
 
     EXPECT_EQ(expected_page_id, query_id_);
-    ASSERT_EQ(expected_num_suggestions, suggestions_.size());
+    ASSERT_LE(expected_num_suggestions, suggestions_.size());

[Mathieu, 2017/01/25 16:28:50]

what happened between 698 and 707 warranting the different checks?

     for (size_t i = 0; i < expected_num_suggestions; ++i) {
       SCOPED_TRACE(base::StringPrintf("i: %" PRIuS, i));
       EXPECT_EQ(expected_suggestions[i].value, suggestions_[i].value);
       EXPECT_EQ(expected_suggestions[i].label, suggestions_[i].label);
       EXPECT_EQ(expected_suggestions[i].icon, suggestions_[i].icon);
       EXPECT_EQ(expected_suggestions[i].frontend_id,
                 suggestions_[i].frontend_id);
     }
+    ASSERT_EQ(expected_num_suggestions, suggestions_.size());
   }
 
   // Wrappers around the above GetSuggestions call that take a hardcoded number
   // of expected results so callsites are cleaner.
   void CheckSuggestions(int expected_page_id,
                         const Suggestion& suggestion0) {
     std::vector<Suggestion> suggestion_vector;
     suggestion_vector.push_back(suggestion0);
     CheckSuggestions(expected_page_id, 1, &suggestion_vector[0]);
   }
@@ skipping 906 matching lines @@
                      IDS_AUTOFILL_CREDIT_CARD_HTTP_WARNING_MESSAGE),
                  l10n_util::GetStringUTF8(IDS_AUTOFILL_HTTP_WARNING_LEARN_MORE),
                  "httpWarning", POPUP_ITEM_ID_HTTP_NOT_SECURE_WARNING_MESSAGE),
 #if !defined(OS_ANDROID)
       Suggestion("", "", "", POPUP_ITEM_ID_SEPARATOR),
 #endif
       Suggestion(
           l10n_util::GetStringUTF8(IDS_AUTOFILL_WARNING_PAYMENT_DISABLED), "",
           "", POPUP_ITEM_ID_INSECURE_CONTEXT_PAYMENT_DISABLED_MESSAGE));
 
-  // Clear the test credit cards and try again -- we shouldn't return a warning.
+  // Clear the test credit cards and try again -- we should still show the
+  // warning.
   personal_data_.ClearCreditCards();
   GetAutofillSuggestions(form, field);
-  // Autocomplete suggestions are queried, but not Autofill.
-  EXPECT_FALSE(external_delegate_->on_suggestions_returned_seen());
+  // Test that we sent the right values to the external delegate.
+  external_delegate_->CheckSuggestions(
+      kDefaultPageID,
+      Suggestion(l10n_util::GetStringUTF8(
+                     IDS_AUTOFILL_CREDIT_CARD_HTTP_WARNING_MESSAGE),
+                 l10n_util::GetStringUTF8(IDS_AUTOFILL_HTTP_WARNING_LEARN_MORE),
+                 "httpWarning", POPUP_ITEM_ID_HTTP_NOT_SECURE_WARNING_MESSAGE));
 }
 
 // Test that we don't show the extra "Payment not secure" warning when the page
 // and the form target URL are secure, even when the switch is on.
 TEST_F(AutofillManagerTest,
        GetCreditCardSuggestions_SecureContextWithHttpBadSwitchOn) {
   SetHttpWarningEnabled();
 
   // Set up our form data.
   FormData form;
@@ skipping 3935 matching lines @@
 
   // The driver should always be notified.
   for (const FormFieldData& field : form.fields) {
     GetAutofillSuggestions(form, field);
     EXPECT_TRUE(autofill_driver_->did_interact_with_credit_card_form());
     autofill_driver_->ClearDidInteractWithCreditCardForm();
   }
 }
 
 }  // namespace autofill