Basic autofill into password value on user gesture only.

chrome/renderer/autofill/password_autofill_agent_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/test/base/chrome_render_view_test.h"
 #include "components/autofill/content/renderer/autofill_agent.h"
 #include "components/autofill/content/renderer/form_autofill_util.h"
 #include "components/autofill/content/renderer/password_autofill_agent.h"
@@ skipping 114 matching lines @@
     "       <script type='text/javascript'>"
     "           function addParagraph() {"
     "             var p = document.createElement('p');"
     "             document.body.appendChild(p);"
     "            }"
     "           window.onload = addParagraph;"
     "       </script>"
     "   </body>"
     "</html>";
 
+const char kJavaScriptClick[] =
+    "var event = new MouseEvent('click', {"
+    "   'view': window,"
+    "   'bubbles': true,"
+    "   'cancelable': true"
+    "});"
+    "var form = document.getElementById('myform1');"
+    "form.dispatchEvent(event);"
+    "console.log('clicked!');";
+
 }  // namespace
 
 namespace autofill {
 
 class PasswordAutofillAgentTest : public ChromeRenderViewTest {
  public:
   PasswordAutofillAgentTest() {
   }
 
   // Simulates the fill password form message being sent to the renderer.
@@ skipping 103 matching lines @@
     blink::WebKeyboardEvent key_event;
     key_event.windowsKeyCode = key_code;
     autofill_agent_->textFieldDidReceiveKeyDown(element, key_event);
   }
 
   void CheckTextFieldsStateForElements(const WebInputElement& username_element,
                                        const std::string& username,
                                        bool username_autofilled,
                                        const WebInputElement& password_element,
                                        const std::string& password,
-                                       bool password_autofilled) {
+                                       bool password_autofilled,
+                                       bool checkSuggestedValue = true) {
     EXPECT_EQ(username,
               static_cast<std::string>(username_element.value().utf8()));
     EXPECT_EQ(username_autofilled, username_element.isAutofilled());
     EXPECT_EQ(password,
-              static_cast<std::string>(password_element.value().utf8()));
+              static_cast<std::string>(
+                  checkSuggestedValue ? password_element.suggestedValue().utf8()
+                                      : password_element.value().utf8()));
     EXPECT_EQ(password_autofilled, password_element.isAutofilled());
   }
 
+  // Checks the DOM-accessible value of the username element and the
+  // *suggested* value of the password element.
   void CheckTextFieldsState(const std::string& username,
                             bool username_autofilled,
                             const std::string& password,
                             bool password_autofilled) {
     CheckTextFieldsStateForElements(username_element_, username,
                                     username_autofilled, password_element_,
                                     password, password_autofilled);
   }
 
+  // Checks the DOM-accessible value of the username element and the
+  // DOM-accessible value of the password element.
+  void CheckTextFieldsDOMState(const std::string& username,
+                               bool username_autofilled,
+                               const std::string& password,
+                               bool password_autofilled) {
+    CheckTextFieldsStateForElements(username_element_,
+                                    username,
+                                    username_autofilled,
+                                    password_element_,
+                                    password,
+                                    password_autofilled,
+                                    false);
+  }
+
   void CheckUsernameSelection(int start, int end) {
     EXPECT_EQ(start, username_element_.selectionStart());
     EXPECT_EQ(end, username_element_.selectionEnd());
   }
 
   string16 username1_;
   string16 username2_;
   string16 username3_;
   string16 password1_;
   string16 password2_;
@@ skipping 485 matching lines @@
 
   // Simulate the user typing in the username in the iframe, which should cause
   // an autofill.
   SimulateUsernameChangeForElement(kAliceUsername, true,
                                    iframe, username_input);
 
   CheckTextFieldsStateForElements(username_input, kAliceUsername, true,
                                   password_input, kAlicePassword, true);
 }
 
+// Tests that a password will only be filled as a suggested and will not be
+// accessible by the DOM until a user gesture has occurred.
+TEST_F(PasswordAutofillAgentTest, GestureRequiredTest) {
+  // Trigger the initial autocomplete.
+  SimulateOnFillPasswordForm(fill_data_);
+
+  // The username and password should have been autocompleted.
+  CheckTextFieldsState(kAliceUsername, true, kAlicePassword, true);
+
+  // However, it should only have completed with the suggested value, as tested
+  // above, and it should not have completed into the DOM accessible value for
+  // the password field.
+  CheckTextFieldsDOMState(kAliceUsername, true, "", true);
+
+  // Simulate a user click so that the password field's real value is filled.
+  SimulateElementClick(kUsernameName);
+  CheckTextFieldsDOMState(kAliceUsername, true, kAlicePassword, true);
+}
+
+// Verfies that a DOM-activated UI event will not cause an autofill.
+TEST_F(PasswordAutofillAgentTest, NoDOMActivationTest) {
+  // Trigger the initial autocomplete.
+  SimulateOnFillPasswordForm(fill_data_);
+
+  ExecuteJavaScript(kJavaScriptClick);
+  CheckTextFieldsDOMState(kAliceUsername, true, "", true);
+}
+
 }  // namespace autofill