Clear username and password from location.href when basic HTTP

Clear username and password from location.href when basic HTTP
authentication is used.

BUG=61946
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=189367

[xleng, 2015-01-27 01:31:45]

xleng@chromium.org changed reviewers:
+ eae@chromium.org, lgarron@chromium.org

[xleng, 2015-01-31 21:16:07]

xleng@chromium.org changed required reviewers:
+ eae@chromium.org

[xleng, 2015-01-31 21:16:37]

PTAL when you have time, or reassign, thanks.

[eae, 2015-02-01 22:25:10]

On 2015/01/31 21:16:37, Tony Leng wrote:
> PTAL when you have time, or reassign, thanks.

What do other browsers do?

[xleng, 2015-02-02 15:55:19]

On 2015/02/01 22:25:10, eae wrote:
> On 2015/01/31 21:16:37, Tony Leng wrote:
> > PTAL when you have time, or reassign, thanks.
> 
> What do other browsers do?

Firefox clears it by default (overridable) in
http://mxr.mozilla.org/mozilla-central/source/docshell/base/nsDefaultURIFixup...,
which is used at
http://mxr.mozilla.org/mozilla-central/source/dom/base/nsLocation.cpp#234,
called by their Location::GetHref at
http://mxr.mozilla.org/mozilla-central/source/dom/base/nsLocation.cpp#460.

Safari doesn't clear it, I'd assume the same of Opera.

[eae, 2015-02-02 21:46:21]

Thanks

LGTM

[xleng, 2015-02-02 22:01:32]

The CQ bit was checked by xleng@chromium.org

[xleng, 2015-02-02 22:01:32]

The CQ bit was unchecked by xleng@chromium.org

[xleng, 2015-02-02 22:01:33]

The CQ bit was checked by xleng@chromium.org

[commit-bot: I haz the power, 2015-02-02 22:01:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/874393006/20001

[commit-bot: I haz the power, 2015-02-02 22:22:25]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=189367