[Password Manager] Fix to recognise failed login attempt for sites where content server pushes new …

chrome/browser/password_manager/password_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram_samples.h"
 #include "base/metrics/statistics_recorder.h"
 #include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/infobars/infobar_service.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/password_manager/password_store_factory.h"
 #include "chrome/browser/password_manager/test_password_store_service.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/login/login_prompt.h"
 #include "chrome/browser/ui/login/login_prompt_test_utils.h"
 #include "chrome/browser/ui/passwords/manage_passwords_ui_controller.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/common/chrome_version_info.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/test_switches.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/autofill/core/browser/autofill_test_utils.h"
+#include "components/content_settings/core/common/content_settings_types.h"

[vabr (Chromium), 2014/08/26 09:42:58]

What do you need this header for?
(If you don't, please remove.)

[Pritam Nikam, 2014/08/26 12:41:32]

Done.

 #include "components/infobars/core/confirm_infobar_delegate.h"
 #include "components/infobars/core/infobar.h"
 #include "components/infobars/core/infobar_manager.h"
 #include "components/password_manager/core/browser/test_password_store.h"
 #include "components/password_manager/core/common/password_manager_switches.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "net/test/spawned_test_server/spawned_test_server.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "ui/gfx/geometry/point.h"
 
 
 // NavigationObserver ---------------------------------------------------------
 
 namespace {
@@ skipping 1057 matching lines @@
   std::string submit =
       "document.getElementById('username').value = 'overwrite_me';"
       "document.getElementById('password').value = 'random';"
       "document.getElementById('non-form-button').click();";
   ASSERT_TRUE(content::ExecuteScript(RenderViewHost(), submit));
   observer.Wait();
 
   EXPECT_TRUE(prompt_observer->IsShowingPrompt());
 }
 
+// Test that if login fails and content server pushes a different login form
+// with action URL having different schemes. Heuristic shall be able
+// identify such cases and *shall not* prompt to save incorrect password.
+IN_PROC_BROWSER_TEST_F(
+    PasswordManagerBrowserTest,
+    NoPromptForLoginFailedAndServerPushSeperateLoginForm_HttpToHttps) {
+  std::string path = "/password/separate_login_form.html";
+  GURL http_url(embedded_test_server()->GetURL(path));
+  ASSERT_TRUE(http_url.SchemeIs(url::kHttpScheme));
+  ui_test_utils::NavigateToURL(browser(), http_url);
+
+  NavigationObserver observer(WebContents());
+  scoped_ptr<PromptObserver> prompt_observer(
+      PromptObserver::Create(WebContents()));
+  std::string submit =
+      "document.getElementById('username_separate').value = 'user';"
+      "document.getElementById('password_separate').value = 'password';"
+      "document.getElementById('submit_separate').click();";
+  ASSERT_TRUE(content::ExecuteScript(RenderViewHost(), submit));
+  observer.Wait();
+
+  EXPECT_FALSE(prompt_observer->IsShowingPrompt());
+}
+
+IN_PROC_BROWSER_TEST_F(
+    PasswordManagerBrowserTest,
+    NoPromptForLoginFailedAndServerPushSeperateLoginForm_HttpsToHttp) {
+  CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kAllowRunningInsecureContent);
+  CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kIgnoreCertificateErrors);
+  const base::FilePath::CharType kDocRoot[] =
+      FILE_PATH_LITERAL("chrome/test/data");
+  net::SpawnedTestServer https_test_server(
+      net::SpawnedTestServer::TYPE_HTTPS,
+      net::SpawnedTestServer::SSLOptions(
+          net::SpawnedTestServer::SSLOptions::CERT_OK),
+      base::FilePath(kDocRoot));
+  ASSERT_TRUE(https_test_server.Start());
+
+  std::string path =
+      "password/separate_login_form_with_onload_submit_script.html";

[vabr (Chromium), 2014/08/26 09:42:58]

Why do you need the onload submit script here?
Could you use the same file password/separate_login_form.html as in the test
above?
(If you need to wait for loading, could you use observer.Wait() instead?)

[Pritam Nikam, 2014/08/26 12:41:33]

std::string submit =
    "document.getElementById('username_separate').value = 'user';"
    "document.getElementById('password_separate').value = 'password';"
    "document.getElementById('submit_separate').click();";

     ASSERT_TRUE(content::ExecuteScript(RenderViewHost(), submit));

For https pages, this fails in ExecuteScript() as it's returning
document.getElementById('id').value as NULL/undefined. I didn't find exact
matching sample for this over HTTPS test server, I've tried adding multiple
command-line flags as well. I even tried executing this under ssl_browser_test
as SSLUITest, but even their it's giving same problem. 
Even I didn't find window.domAutomationController.send() with script working.

+  GURL https_url(https_test_server.GetURL(path));
+  ASSERT_TRUE(https_url.SchemeIs(url::kHttpsScheme));
+
+  NavigationObserver observer(WebContents());
+  scoped_ptr<PromptObserver> prompt_observer(
+      PromptObserver::Create(WebContents()));
+  ui_test_utils::NavigateToURL(browser(), https_url);
+
+  // Waits for navigation complete.
+  observer.Wait();
+
+  // Waits for form submission by onload javascript.
+  observer.Wait();

[vabr (Chromium), 2014/08/26 09:42:58]

I'm afraid this will be a source of flakiness. Suppose the browser manages to
both load the first page, and submit the form before the Wait() call on line
1177 finishes. In that case, the call here, on 1180, will get stuck until
timeoff, and the test will fail for no good reason.
Please use the same pattern as in the test you added above.

[Pritam Nikam, 2014/08/26 12:41:33]

As explained in previous comments, content::ExecuteScript() fail to execute 
document.getElementById('username_separate').value is undefined.

+
+  // Verify that browser doest not prompt save password popup.

[vabr (Chromium), 2014/08/26 09:42:58]

nit: You can drop this comment, the code below is self-documenting.

[Pritam Nikam, 2014/08/26 12:41:33]

Done.

+  EXPECT_FALSE(prompt_observer->IsShowingPrompt());
+}