AutoFill: Only send credit card data suggestions on HTTPS sites.

BUG=48499
TEST=AutoFillManagerTest.GetCreditCardSuggestionsNonHTTPS

Review URL: http://codereview.chromium.org/2941009

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@52207 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 33 insertions, 7 deletions

diff --git a/chrome/browser/autofill/autofill_manager.cc b/chrome/browser/autofill/autofill_manager.cc
index c008cc9..d3cceef 100644
--- a/chrome/browser/autofill/autofill_manager.cc
+++ b/chrome/browser/autofill/autofill_manager.cc
@@ -17,6 +17,7 @@
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
+#include "chrome/common/url_constants.h"
 #include "webkit/glue/form_data.h"
 #include "webkit/glue/form_field.h"
 
@@ -525,6 +526,10 @@ void AutoFillManager::GetCreditCardSuggestions(FormStructure* form,
                                                AutoFillType type,
                                                std::vector<string16>* values,
                                                std::vector<string16>* labels) {
+  // Don't return CC suggestions for non-HTTPS pages.
+  if (!form->ConvertToFormData().origin.SchemeIs(chrome::kHttpsScheme))
+    return;
+
   for (std::vector<CreditCard*>::const_iterator iter =
            personal_data_->credit_cards().begin();
        iter != personal_data_->credit_cards().end(); ++iter) {
diff --git a/chrome/browser/autofill/autofill_manager_unittest.cc b/chrome/browser/autofill/autofill_manager_unittest.cc
index 8aeeb25..2acfc92 100644
--- a/chrome/browser/autofill/autofill_manager_unittest.cc
+++ b/chrome/browser/autofill/autofill_manager_unittest.cc
@@ -164,8 +164,8 @@ void CreateTestFormData(FormData* form) {
 void CreateTestFormDataBilling(FormData* form) {
   form->name = ASCIIToUTF16("MyForm");
   form->method = ASCIIToUTF16("POST");
-  form->origin = GURL("http://myform.com/form.html");
-  form->action = GURL("http://myform.com/submit.html");
+  form->origin = GURL("https://myform.com/form.html");
+  form->action = GURL("https://myform.com/submit.html");
 
   webkit_glue::FormField field;
   autofill_unittest::CreateTestFormField(
@@ -520,6 +520,27 @@ TEST_F(AutoFillManagerTest, GetCreditCardSuggestionsSemicolon) {
   EXPECT_EQ(ASCIIToUTF16("Home; 8765; 8765"), labels[7]);
 }
 
+TEST_F(AutoFillManagerTest, GetCreditCardSuggestionsNonHTTPS) {
+  FormData form;
+  CreateTestFormDataBilling(&form);
+  form.origin = GURL("http://myform.com/form.html");
+
+  // Set up our FormStructures.
+  std::vector<FormData> forms;
+  forms.push_back(form);
+  autofill_manager_->FormsSeen(forms);
+
+  // The page ID sent to the AutoFillManager from the RenderView, used to send
+  // an IPC message back to the renderer.
+  const int kPageID = 1;
+
+  webkit_glue::FormField field;
+  autofill_unittest::CreateTestFormField(
+      "Card Number", "cardnumber", "", "text", &field);
+  EXPECT_FALSE(
+      autofill_manager_->GetAutoFillSuggestions(kPageID, false, field));
+}
+
 TEST_F(AutoFillManagerTest, GetCombinedAutoFillAndAutocompleteSuggestions) {
   FormData form;
   CreateTestFormData(&form);
@@ -700,8 +721,8 @@ TEST_F(AutoFillManagerTest, FillCreditCardForm) {
   EXPECT_TRUE(GetAutoFillFormDataFilledMessage(&page_id, &results));
   EXPECT_EQ(ASCIIToUTF16("MyForm"), results.name);
   EXPECT_EQ(ASCIIToUTF16("POST"), results.method);
-  EXPECT_EQ(GURL("http://myform.com/form.html"), results.origin);
-  EXPECT_EQ(GURL("http://myform.com/submit.html"), results.action);
+  EXPECT_EQ(GURL("https://myform.com/form.html"), results.origin);
+  EXPECT_EQ(GURL("https://myform.com/submit.html"), results.action);
   ASSERT_EQ(15U, results.fields.size());
 
   webkit_glue::FormField field;
@@ -854,8 +875,8 @@ TEST_F(AutoFillManagerTest, FillBillFormSemicolon) {
   EXPECT_TRUE(GetAutoFillFormDataFilledMessage(&page_id, &results));
   EXPECT_EQ(ASCIIToUTF16("MyForm"), results.name);
   EXPECT_EQ(ASCIIToUTF16("POST"), results.method);
-  EXPECT_EQ(GURL("http://myform.com/form.html"), results.origin);
-  EXPECT_EQ(GURL("http://myform.com/submit.html"), results.action);
+  EXPECT_EQ(GURL("https://myform.com/form.html"), results.origin);
+  EXPECT_EQ(GURL("https://myform.com/submit.html"), results.action);
   ASSERT_EQ(15U, results.fields.size());
 
   webkit_glue::FormField field;
diff --git a/chrome/browser/autofill/form_structure.h b/chrome/browser/autofill/form_structure.h
index 1ba357b..8ce5a18 100644
--- a/chrome/browser/autofill/form_structure.h
+++ b/chrome/browser/autofill/form_structure.h
@@ -137,7 +137,7 @@ class FormStructure {
   bool has_autofillable_field_;
   bool has_password_fields_;
 
-  // The number of fields able to be autofilled.
+  // The number of fields able to be auto-filled.
   size_t autofill_count_;
 
   // A vector of all the input fields in the form.  The vector is terminated by