Add a flag to control referring app info.

Add SafeBrowsingPasswordProtectionReferringAppEnabledAndroid to control
whether to include referring app info in password protection requests
on Android. The flag is disabled by default.

Bug: 1154860
Change-Id: I26d0384601f84067a00bc08a548fc4f7f14eb8c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2638781Reviewed-by: Bettina Dea <bdea@chromium.org>
Commit-Queue: Xinghui Lu <xinghuilu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#845297}

components/safe_browsing/content/password_protection/password_protection_request.cc

@@ -278,6 +278,8 @@ void PasswordProtectionRequest::FillRequestProto(bool is_sampled_ping) {
 #endif  // BUILDFLAG(FULL_SAFE_BROWSING)
 
 #if defined(OS_ANDROID)
+  if (base::FeatureList::IsEnabled(
+          safe_browsing::kPasswordProtectionReferringAppEnabledAndroid)) {
     LoginReputationClientRequest::ReferringAppInfo referring_app_info =
         password_protection_service_->GetReferringAppInfo(web_contents_);
     UMA_HISTOGRAM_ENUMERATION(
@@ -285,7 +287,9 @@ void PasswordProtectionRequest::FillRequestProto(bool is_sampled_ping) {
         referring_app_info.referring_app_source(),
         LoginReputationClientRequest::ReferringAppInfo::ReferringAppSource_MAX +
             1);
-  *request_proto_->mutable_referring_app_info() = std::move(referring_app_info);
+    *request_proto_->mutable_referring_app_info() =
+        std::move(referring_app_info);
+  }
 #endif  // defined(OS_ANDROID)
 
   switch (trigger_type_) {

components/safe_browsing/core/features.cc

@@ -69,6 +69,10 @@ const base::Feature kPasswordProtectionForSavedPasswords{
     "SafeBrowsingPasswordProtectionForSavedPasswords",
     base::FEATURE_ENABLED_BY_DEFAULT};
 
+const base::Feature kPasswordProtectionReferringAppEnabledAndroid{
+    "SafeBrowsingPasswordProtectionReferringAppEnabledAndroid",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+
 const base::Feature kPasswordProtectionShowDomainsForSavedPasswords{
     "SafeBrowsingPasswordProtectionShowDomainsForSavedPasswords",
     base::FEATURE_ENABLED_BY_DEFAULT};
@@ -151,6 +155,7 @@ constexpr struct {
     {&kEnhancedProtectionMessageInInterstitials, true},
     {&kLimitedListSizeForIOS, true},
     {&kPasswordProtectionForSavedPasswords, true},
+    {&kPasswordProtectionReferringAppEnabledAndroid, true},
     {&kPasswordProtectionShowDomainsForSavedPasswords, true},
     {&kPasswordProtectionForSignedInUsers, true},
     {&kPromptAppForDeepScanning, true},

components/safe_browsing/core/features.h

@@ -58,6 +58,9 @@ extern const base::Feature kLimitedListSizeForIOS;
 // Enable password protection for non-Google accounts.
 extern const base::Feature kPasswordProtectionForSavedPasswords;
 
+// Include referring app info in password protection requests on Android.
+extern const base::Feature kPasswordProtectionReferringAppEnabledAndroid;
+
 // Enable whether or not to show a list of domains the saved password was used
 // on the modal warning dialog during password protection. This is only checked
 // if the |kPasswordProtectionForSavedPasswords| experiment is on.