[Password Generation] Require full form match to allow generation

chrome/renderer/autofill/password_generation_agent_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string.h>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/histogram_tester.h"
 #include "chrome/test/base/chrome_render_view_test.h"
 #include "components/autofill/content/common/autofill_messages.h"
 #include "components/autofill/content/renderer/autofill_agent.h"
+#include "components/autofill/content/renderer/form_autofill_util.h"
 #include "components/autofill/content/renderer/test_password_generation_agent.h"
 #include "components/autofill/core/common/form_data.h"
 #include "components/autofill/core/common/password_generation_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebWidget.h"
 
 using blink::WebDocument;
@@ skipping 14 matching lines @@
   }
 
   void SetNotBlacklistedMessage(const char* form_str) {
     autofill::PasswordForm form;
     form.origin =
         GURL(base::StringPrintf("data:text/html;charset=utf-8,%s", form_str));
     AutofillMsg_FormNotBlacklisted msg(0, form);
     password_generation_->OnMessageReceived(msg);
   }
 
-  void SetAccountCreationFormsDetectedMessage(const char* form_str) {
-    autofill::FormData form;
-    form.origin =
-        GURL(base::StringPrintf("data:text/html;charset=utf-8,%s", form_str));
+  // Sends a message that the |form_index| form on the page is valid for
+  // account creation.
+  void SetAccountCreationFormsDetectedMessage(int form_index) {
+    WebDocument document = GetMainFrame()->document();
+    blink::WebVector<blink::WebFormElement> web_forms;
+    document.forms(web_forms);
+
+    autofill::FormData form_data;
+    WebFormElementToFormData(web_forms[form_index],
+                             blink::WebFormControlElement(),
+                             REQUIRE_NONE,
+                             EXTRACT_NONE,
+                             &form_data,
+                             NULL /* FormFieldData */);
+
     std::vector<autofill::FormData> forms;
-    forms.push_back(form);
+    forms.push_back(form_data);
     AutofillMsg_AccountCreationFormsDetected msg(0, forms);
     password_generation_->OnMessageReceived(msg);
   }
 
   void ExpectPasswordGenerationAvailable(const char* element_id,
                                          bool available) {
     WebDocument document = GetMainFrame()->document();
     WebElement element =
         document.getElementById(WebString::fromUTF8(element_id));
     ASSERT_FALSE(element.isNull());
@@ skipping 40 matching lines @@
     "</FORM>";
 
 const char kInvalidActionAccountCreationFormHTML[] =
     "<FORM name = 'blah' action = 'invalid'> "
     "  <INPUT type = 'text' id = 'username'/> "
     "  <INPUT type = 'password' id = 'first_password'/> "
     "  <INPUT type = 'password' id = 'second_password'/> "
     "  <INPUT type = 'submit' value = 'LOGIN' />"
     "</FORM>";
 
+const char kMultipleAccountCreationFormHTML[] =
+    "<FORM name = 'login' action = 'http://www.random.com/'> "
+    "  <INPUT type = 'text' id = 'random'/> "
+    "  <INPUT type = 'text' id = 'username'/> "
+    "  <INPUT type = 'password' id = 'password'/> "
+    "  <INPUT type = 'submit' value = 'LOGIN' />"
+    "</FORM>"
+    "<FORM name = 'signup' action = 'http://www.random.com/signup'> "
+    "  <INPUT type = 'text' id = 'username'/> "
+    "  <INPUT type = 'password' id = 'first_password' "
+    "         autocomplete = 'off' size = 5/>"
+    "  <INPUT type = 'password' id = 'second_password' size = 5/> "
+    "  <INPUT type = 'text' id = 'address'/> "
+    "  <INPUT type = 'submit' value = 'LOGIN' />"
+    "</FORM>";
+
 const char ChangeDetectionScript[] =
     "<script>"
     "  firstOnChangeCalled = false;"
     "  secondOnChangeCalled = false;"
     "  document.getElementById('first_password').onchange = function() {"
     "    firstOnChangeCalled = true;"
     "  };"
     "  document.getElementById('second_password').onchange = function() {"
     "    secondOnChangeCalled = true;"
     "  };"
     "</script>";
 
 TEST_F(PasswordGenerationAgentTest, DetectionTest) {
   // Don't shown the icon for non account creation forms.
   LoadHTML(kSigninFormHTML);
   ExpectPasswordGenerationAvailable("password", false);
 
   // We don't show the decoration yet because the feature isn't enabled.
   LoadHTML(kAccountCreationFormHTML);
   ExpectPasswordGenerationAvailable("first_password", false);
 
   // Pretend like We have received message indicating site is not blacklisted,
   // and we have received message indicating the form is classified as
   // ACCOUNT_CREATION_FORM form Autofill server. We should show the icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 
   // Hidden fields are not treated differently.
   LoadHTML(kHiddenPasswordAccountCreationFormHTML);
   SetNotBlacklistedMessage(kHiddenPasswordAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(
-      kHiddenPasswordAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 
   // This doesn't trigger because the form action is invalid.
   LoadHTML(kInvalidActionAccountCreationFormHTML);
   SetNotBlacklistedMessage(kInvalidActionAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kInvalidActionAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", false);
 }
 
 TEST_F(PasswordGenerationAgentTest, FillTest) {
   // Make sure that we are enabled before loading HTML.
   std::string html = std::string(kAccountCreationFormHTML) +
       ChangeDetectionScript;
   LoadHTML(html.c_str());
+  SetNotBlacklistedMessage(html.c_str());
+  SetAccountCreationFormsDetectedMessage(0);
 
   WebDocument document = GetMainFrame()->document();
   WebElement element =
       document.getElementById(WebString::fromUTF8("first_password"));
   ASSERT_FALSE(element.isNull());
   WebInputElement first_password_element = element.to<WebInputElement>();
   element = document.getElementById(WebString::fromUTF8("second_password"));
   ASSERT_FALSE(element.isNull());
   WebInputElement second_password_element = element.to<WebInputElement>();
 
@@ skipping 29 matching lines @@
   // TODO(zysxqn): Change this back to the address element once Bug 90224
   // https://bugs.webkit.org/show_bug.cgi?id=90224 has been fixed.
   element = document.getElementById(WebString::fromUTF8("first_password"));
   ASSERT_FALSE(element.isNull());
   EXPECT_EQ(element, document.focusedElement());
 }
 
 TEST_F(PasswordGenerationAgentTest, EditingTest) {
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
 
   WebDocument document = GetMainFrame()->document();
   WebElement element =
       document.getElementById(WebString::fromUTF8("first_password"));
   ASSERT_FALSE(element.isNull());
   WebInputElement first_password_element = element.to<WebInputElement>();
   element = document.getElementById(WebString::fromUTF8("second_password"));
   ASSERT_FALSE(element.isNull());
   WebInputElement second_password_element = element.to<WebInputElement>();
 
@@ skipping 28 matching lines @@
   // processed.
   base::MessageLoop::current()->RunUntilIdle();
   EXPECT_EQ(empty_password, first_password_element.value());
   EXPECT_EQ(empty_password, second_password_element.value());
 }
 
 TEST_F(PasswordGenerationAgentTest, BlacklistedTest) {
   // Did not receive not blacklisted message. Don't show password generation
   // icon.
   LoadHTML(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", false);
 
   // Receive one not blacklisted message for non account creation form. Don't
   // show password generation icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kSigninFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", false);
 
   // Receive one not blackliste message for account creation form. Show password
   // generation icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 
   // Receive two not blacklisted messages, one is for account creation form and
   // the other is not. Show password generation icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kSigninFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 }
 
 TEST_F(PasswordGenerationAgentTest, AccountCreationFormsDetectedTest) {
   // Did not receive account creation forms detected messege. Don't show
   // password generation icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
   ExpectPasswordGenerationAvailable("first_password", false);
 
   // Receive the account creation forms detected message. Show password
   // generation icon.
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 }
 
 TEST_F(PasswordGenerationAgentTest, MaximumOfferSize) {
   base::HistogramTester histogram_tester;
 
   LoadHTML(kAccountCreationFormHTML);
   SetNotBlacklistedMessage(kAccountCreationFormHTML);
-  SetAccountCreationFormsDetectedMessage(kAccountCreationFormHTML);
+  SetAccountCreationFormsDetectedMessage(0);
   ExpectPasswordGenerationAvailable("first_password", true);
 
   WebDocument document = GetMainFrame()->document();
   WebElement element =
       document.getElementById(WebString::fromUTF8("first_password"));
   ASSERT_FALSE(element.isNull());
   WebInputElement first_password_element = element.to<WebInputElement>();
 
   // Make a password just under maximum offer size.
   first_password_element.setValue(
@@ skipping 63 matching lines @@
 
   histogram_tester.ExpectBucketCount(
       "PasswordGeneration.Event",
       autofill::password_generation::GENERATION_POPUP_SHOWN,
       1);
 }
 
 TEST_F(PasswordGenerationAgentTest, DynamicFormTest) {
   LoadHTML(kSigninFormHTML);
   SetNotBlacklistedMessage(kSigninFormHTML);
-  SetAccountCreationFormsDetectedMessage(kSigninFormHTML);
 
   ExecuteJavaScript(
       "var form = document.createElement('form');"
       "var username = document.createElement('input');"
       "username.type = 'text';"
       "username.id = 'dynamic_username';"
       "var first_password = document.createElement('input');"
       "first_password.type = 'password';"
       "first_password.id = 'first_password';"
       "first_password.name = 'first_password';"
       "var second_password = document.createElement('input');"
       "second_password.type = 'password';"
       "second_password.id = 'second_password';"
       "second_password.name = 'second_password';"
       "form.appendChild(username);"
       "form.appendChild(first_password);"
       "form.appendChild(second_password);"
       "document.body.appendChild(form);");
   ProcessPendingMessages();
+
+  // This needs to come after the DOM has been modified.
+  SetAccountCreationFormsDetectedMessage(1);
+
   // TODO(gcasto): I'm slighty worried about flakes in this test where
   // didAssociateFormControls() isn't called. If this turns out to be a problem
   // adding a call to OnDynamicFormsSeen(GetMainFrame()) will fix it, though
   // it will weaken the test.
   ExpectPasswordGenerationAvailable("first_password", true);
 }
 
+TEST_F(PasswordGenerationAgentTest, MultiplePasswordFormsTest) {
+  // If two forms on the page looks like possible account creation forms, make
+  // sure to trigger on the one that is specified from Autofill.
+  LoadHTML(kMultipleAccountCreationFormHTML);
+  SetNotBlacklistedMessage(kMultipleAccountCreationFormHTML);
+
+  // Should trigger on the second form.
+  SetAccountCreationFormsDetectedMessage(1);
+
+  ExpectPasswordGenerationAvailable("password", false);
+
+  // TODO(gcasto): Enable this check once we examine multiple heuristic matches.
+  //ExpectPasswordGenerationAvailable("first_password", true);
+}
+
 }  // namespace autofill