Don't trigger Phishguard pings if we cannot compute URL reputation.

components/safe_browsing/password_protection/password_protection_service.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/safe_browsing/password_protection/password_protection_service.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/safe_browsing/password_protection/password_protection_request.h"
 #include "components/safe_browsing_db/database_manager.h"
 #include "components/safe_browsing_db/v4_protocol_manager_util.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/web_contents.h"
 #include "google_apis/google_api_keys.h"
 #include "net/base/escape.h"
+#include "net/base/url_util.h"
 
 using content::BrowserThread;
+using content::WebContents;
 using history::HistoryService;
 
 namespace safe_browsing {
 
 namespace {
 
 // Keys for storing password protection verdict into a DictionaryValue.
 const char kCacheCreationTime[] = "cache_creation_time";
 const char kVerdictProto[] = "verdict_proto";
 const int kRequestTimeoutMs = 10000;
@@ skipping 64 matching lines @@
 }
 
 void PasswordProtectionService::CheckCsdWhitelistOnIOThread(
     const GURL& url,
     bool* check_result) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   *check_result =
       url.is_valid() ? database_manager_->MatchCsdWhitelistUrl(url) : true;
 }
 
+bool PasswordProtectionService::CanGetReputationOfURL(const GURL& url) {
+  if (!url.is_valid() || !url.SchemeIsHTTPOrHTTPS())
+    return false;
+
+  const std::string& hostname = url.HostNoBrackets();
+  return !net::IsLocalhost(hostname) && !net::IsHostnameNonUnique(hostname) &&
+         hostname.find('.') != std::string::npos;
+}
+
 LoginReputationClientResponse::VerdictType
 PasswordProtectionService::GetCachedVerdict(
     const GURL& url,
     LoginReputationClientResponse* out_response) {
   if (!url.is_valid())
     return LoginReputationClientResponse::VERDICT_TYPE_UNSPECIFIED;
 
   DCHECK(content_settings_);
 
   GURL hostname = GetHostNameWithHTTPScheme(url);
@@ skipping 125 matching lines @@
       // |verdict_diectionary|.
       content_settings_->SetWebsiteSettingDefaultScope(
           primary_pattern_url, GURL(),
           CONTENT_SETTINGS_TYPE_PASSWORD_PROTECTION, std::string(),
           std::move(verdict_dictionary));
     }
   }
 }
 
 void PasswordProtectionService::StartRequest(
+    WebContents* web_contents,
     const GURL& main_frame_url,
     const GURL& password_form_action,
     const GURL& password_form_frame_url,
     const std::string& saved_domain,
     LoginReputationClientRequest::TriggerType type) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   scoped_refptr<PasswordProtectionRequest> request(
-      new PasswordProtectionRequest(main_frame_url, password_form_action,
+      new PasswordProtectionRequest(web_contents, main_frame_url,
+                                    password_form_action,
                                     password_form_frame_url, saved_domain, type,
                                     this, GetRequestTimeoutInMS()));
   DCHECK(request);
   request->Start();
   requests_.insert(std::move(request));
 }
 
 void PasswordProtectionService::MaybeStartPasswordFieldOnFocusRequest(
+    WebContents* web_contents,
     const GURL& main_frame_url,
     const GURL& password_form_action,
     const GURL& password_form_frame_url) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  RequestOutcome request_outcome;
-  if (!IsPingingEnabled(kPasswordFieldOnFocusPinging, &request_outcome)) {
-    RecordPingingDisabledReason(kPasswordFieldOnFocusPinging, request_outcome);
-    return;
+  if (CanSendPing(kPasswordFieldOnFocusPinging, main_frame_url)) {
+    StartRequest(web_contents, main_frame_url, password_form_action,
+                 password_form_frame_url,
+                 std::string(), /* saved_domain: not used for this type */
+                 LoginReputationClientRequest::UNFAMILIAR_LOGIN_PAGE);
   }
-
-  // Skip URLs that we can't get a reliable reputation for.
-  if (!main_frame_url.is_valid() || !main_frame_url.SchemeIsHTTPOrHTTPS()) {
-    return;
-  }
-
-  StartRequest(main_frame_url, password_form_action, password_form_frame_url,
-               std::string(), /* saved_domain: not used for this type */
-               LoginReputationClientRequest::UNFAMILIAR_LOGIN_PAGE);
 }
 
 void PasswordProtectionService::MaybeStartProtectedPasswordEntryRequest(
+    WebContents* web_contents,
     const GURL& main_frame_url,
     const std::string& saved_domain) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  RequestOutcome request_outcome;
-  if (!IsPingingEnabled(kProtectedPasswordEntryPinging, &request_outcome)) {
-    RecordPingingDisabledReason(kProtectedPasswordEntryPinging,
-                                request_outcome);
-    return;
+  if (CanSendPing(kProtectedPasswordEntryPinging, main_frame_url)) {
+    StartRequest(web_contents, main_frame_url, GURL(), GURL(), saved_domain,
+                 LoginReputationClientRequest::PASSWORD_REUSE_EVENT);
   }
+}
 
-  // Skip URLs that we can't get a reliable reputation for.
-  if (!main_frame_url.is_valid() || !main_frame_url.SchemeIsHTTPOrHTTPS()) {
-    return;
+bool PasswordProtectionService::CanSendPing(const base::Feature& feature,
+                                            const GURL& main_frame_url) {
+  RequestOutcome request_outcome = URL_NOT_VALID_FOR_REPUTATION_COMPUTING;
+  if (IsPingingEnabled(kPasswordFieldOnFocusPinging, &request_outcome) &&
+      CanGetReputationOfURL(main_frame_url)) {
+    return true;
   }
-
-  StartRequest(main_frame_url, GURL(), GURL(), saved_domain,
-               LoginReputationClientRequest::PASSWORD_REUSE_EVENT);
+  RecordNoPingingReason(feature, request_outcome);
+  return false;
 }
 
 void PasswordProtectionService::RequestFinished(
     PasswordProtectionRequest* request,
     std::unique_ptr<LoginReputationClientResponse> response) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   DCHECK(request);
-  // TODO(jialiul): We don't cache verdict for incognito mode for now.
-  // Later we may consider temporarily caching verdict.
-  if (response && !IsIncognito())
+  if (response)
     CacheVerdict(request->main_frame_url(), response.get(), base::Time::Now());
 
   // Finished processing this request. Remove it from pending list.
   for (auto it = requests_.begin(); it != requests_.end(); it++) {
     if (it->get() == request) {
       requests_.erase(it);
       break;
     }
   }
 }
@@ skipping 218 matching lines @@
   const std::string serialized_proto(verdict->SerializeAsString());
   const std::vector<char> verdict_blob(serialized_proto.begin(),
                                        serialized_proto.end());
   std::unique_ptr<base::Value> binary_value =
       base::MakeUnique<base::Value>(verdict_blob);
   DCHECK_EQ(base::Value::Type::BINARY, binary_value->type());
   result->Set(kVerdictProto, std::move(binary_value));
   return result;
 }
 
-void PasswordProtectionService::RecordPingingDisabledReason(
+void PasswordProtectionService::RecordNoPingingReason(
     const base::Feature& feature,
     RequestOutcome reason) {
   DCHECK(feature.name == kProtectedPasswordEntryPinging.name ||
          feature.name == kPasswordFieldOnFocusPinging.name);
 
   bool is_password_entry_ping =
       feature.name == kProtectedPasswordEntryPinging.name;
 
   if (is_password_entry_ping) {
     UMA_HISTOGRAM_ENUMERATION(kPasswordEntryRequestOutcomeHistogramName, reason,
                               MAX_OUTCOME);
   } else {
     UMA_HISTOGRAM_ENUMERATION(kPasswordOnFocusRequestOutcomeHistogramName,
                               reason, MAX_OUTCOME);
   }
 }
 
 }  // namespace safe_browsing