Prevent usage of web payments API over insecure HTTPS.

ios/chrome/browser/payments/payment_request.mm

Index: ios/chrome/browser/payments/payment_request.mm
diff --git a/ios/chrome/browser/payments/payment_request.mm b/ios/chrome/browser/payments/payment_request.mm
index 2a7d7ff75b9e71b67fa4852eb97d532446a5d4d2..31dcf99201ec68de5c7e207bd23f6a042f7e4d6e 100644
--- a/ios/chrome/browser/payments/payment_request.mm
+++ b/ios/chrome/browser/payments/payment_request.mm
@@ -108,13 +108,10 @@ void PaymentRequest::PopulateProfileCache() {
 }
 
 void PaymentRequest::PopulateCreditCardCache() {
-  if (!payments::data_util::ParseBasicCardSupportedNetworks(
-          web_payment_request_.method_data, &supported_card_networks_,
-          &basic_card_specified_networks_)) {
-    // TODO(crbug.com/709036): close the UI and reject the promise since the
-    // data is invalid.
-    return;
-  }
+  // TODO(crbug.com/709036): Validate method data.

[palmer, 2017/04/17 19:30:06]

How will the caller distinguish empty data from invalid input? Rejected Promise
vs. empty result? Is that important? (I.e. why change from bool to void)

[please use gerrit instead, 2017/04/17 20:06:10]

The renderer should have validated all data beforehand and prevented invalid
data going into the browser. If the browser receives invalid data nevertheless,
then the renderer has been compromised. The web payments API should hard-abort
and disconnect from the renderer. (Terminating the renderer would be best.)

The old function used to treat absence of "basic-card" in the
|web_payment_request_.method_data| as invalid data from the renderer
(hard-abort). This does not match the spec. Instead, the code should perform
these two operations gracefully:
1) Resolve any caneMakePayment() promise with "false".
2) Reject any show() promise with "NotSupportedError".

I've added this information to the bug in the TODO comment.

+  payments::data_util::ParseBasicCardSupportedNetworks(
+      web_payment_request_.method_data, &supported_card_networks_,
+      &basic_card_specified_networks_);
 
   const std::vector<autofill::CreditCard*>& credit_cards_to_suggest =
       personal_data_manager_->GetCreditCardsToSuggest();