Expose passwords to JavaScript in Credential Manager API

third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp

Index: third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
diff --git a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
index 8336951f821d8898d2c15b9d34eafd6b6fb5e23d..3121ac9eb968186fb5a1454b5150154279ee2f1c 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
@@ -14,6 +14,7 @@
 #include "core/html/ListedElement.h"
 #include "modules/credentialmanager/FormDataOptions.h"
 #include "modules/credentialmanager/PasswordCredentialData.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/credentialmanager/PlatformPasswordCredential.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/WebCredential.h"
@@ -132,6 +133,14 @@ PasswordCredential::PasswordCredential(const String& id,
       id_name_("username"),
       password_name_("password") {}
 
+const String& PasswordCredential::password() const {
+  return RuntimeEnabledFeatures::passwordCredentialPasswordEnabled()

[Mike West, 2017/05/16 09:30:45]

I think you can safely change this to:

```
return
static_cast<PlatformPasswordCredential*>(platform_credential_.Get())->Password();
```

as the guard you put into the IDL file will prevent it from being called from
the web if it's not meant to be available.

(That is, you can just rename and move the existing `Password()` method)

[jdoerrie, 2017/05/17 15:39:22]

Done.

+             ? static_cast<PlatformPasswordCredential*>(
+                   platform_credential_.Get())
+                   ->Password()
+             : empty_password_;
+}
+
 PassRefPtr<EncodedFormData> PasswordCredential::EncodeFormData(
     String& content_type) const {
   if (additional_data_.isURLSearchParams()) {
@@ -145,7 +154,7 @@ PassRefPtr<EncodedFormData> PasswordCredential::EncodeFormData(
         params->append(name, param.second);
     }
     params->append(idName(), id());
-    params->append(passwordName(), Password());
+    params->append(passwordName(), password());

[Mike West, 2017/05/16 09:30:45]

I don't think this is going to work, as the current code will prevent the
password from being sent out via `fetch()` unless the runtime flag is set. Doing
the change above should make this work again.

[jdoerrie, 2017/05/17 15:39:22]

Acknowledged.

 
     content_type =
         AtomicString("application/x-www-form-urlencoded;charset=UTF-8");
@@ -169,7 +178,7 @@ PassRefPtr<EncodedFormData> PasswordCredential::EncodeFormData(
     }
   }
   form_data->append(idName(), id());
-  form_data->append(passwordName(), Password());
+  form_data->append(passwordName(), password());
 
   RefPtr<EncodedFormData> encoded_data = form_data->EncodeMultiPartFormData();
   content_type = AtomicString("multipart/form-data; boundary=") +
@@ -177,11 +186,6 @@ PassRefPtr<EncodedFormData> PasswordCredential::EncodeFormData(
   return encoded_data.Release();
 }
 
-const String& PasswordCredential::Password() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->Password();
-}
-
 DEFINE_TRACE(PasswordCredential) {
   CredentialUserData::Trace(visitor);
   visitor->Trace(additional_data_);