Use a standard scheme to test potential trustworthiness

In [1] a test was added to to verify trustworthiness of custom schemes.
However, the ones using IsOriginPotentiallyTrustworthy fails because
non-opaque origin must be a "standard scheme" i.e. follow [2]. This CL
adjusts the tests to actually use a "standard scheme", which is closer
the intent to test chrome-extension URLs. It also removes corresponding
test from SecurityOriginTest, as it does work well with url utils [3].

[1] https://chromium-review.googlesource.com/c/chromium/src/+/2593629
[2] https://tools.ietf.org/html/rfc3986#section-3
[3] crbug.com/1163060

Bug: 1153336, 1163060
Change-Id: I3e7f1d91558a97b1722a742d89c514b984b56ac2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2595424Reviewed-by: Mike West <mkwst@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Commit-Queue: Frédéric Wang <fwang@igalia.com>
Cr-Commit-Position: refs/heads/master@{#841991}

services/network/public/cpp/is_potentially_trustworthy_unittest.cc

@@ -51,7 +51,6 @@ TEST(IsPotentiallyTrustworthy, Origin) {
   EXPECT_FALSE(IsOriginPotentiallyTrustworthy("javascript:alert('blah')"));
   EXPECT_FALSE(IsOriginPotentiallyTrustworthy("data:test/plain;blah"));
 
-  EXPECT_FALSE(IsOriginPotentiallyTrustworthy("custom-scheme://example.com"));
   EXPECT_TRUE(
       IsOriginPotentiallyTrustworthy("quic-transport://example.com/counter"));
 }
@@ -150,18 +149,39 @@ TEST(IsPotentiallyTrustworthy, Url) {
 
   EXPECT_TRUE(
       IsUrlPotentiallyTrustworthy("quic-transport://example.com/counter"));
-  EXPECT_FALSE(IsUrlPotentiallyTrustworthy("custom-scheme://example.com"));
 }
 
+// Tests the trustworthiness of an URL and origin whose scheme was added to the
+// custom sets of standard and secure schemes. A scheme must be added to both
+// to be considered trustworthy.
 TEST(IsPotentiallyTrustworthy, CustomScheme) {
+  const char* custom_scheme = "custom-scheme";
+  const char* custom_scheme_example = "custom-scheme://example.com";
+
+  EXPECT_FALSE(IsOriginPotentiallyTrustworthy(custom_scheme_example));
+  EXPECT_FALSE(IsUrlPotentiallyTrustworthy(custom_scheme_example));
+
+  {
     url::ScopedSchemeRegistryForTests scoped_registry;
-  url::AddSecureScheme("custom-scheme");
+    url::AddSecureScheme(custom_scheme);
+    EXPECT_FALSE(IsOriginPotentiallyTrustworthy(custom_scheme_example));
+    EXPECT_FALSE(IsUrlPotentiallyTrustworthy(custom_scheme_example));
+  }
 
-  // TODO(crbug.com/1159371): These tests should return true.
-  EXPECT_FALSE(IsOriginPotentiallyTrustworthy(
-      "custom-scheme://578223a1-8c13-17b3-84d5-eca045ae384a/fun.js"));
-  EXPECT_FALSE(IsUrlPotentiallyTrustworthy(
-      "custom-scheme://578223a1-8c13-17b3-84d5-eca045ae384a/fun.js"));
+  {
+    url::ScopedSchemeRegistryForTests scoped_registry;
+    url::AddStandardScheme(custom_scheme, url::SchemeType::SCHEME_WITH_HOST);
+    EXPECT_FALSE(IsOriginPotentiallyTrustworthy(custom_scheme_example));
+    EXPECT_FALSE(IsUrlPotentiallyTrustworthy(custom_scheme_example));
+  }
+
+  {
+    url::ScopedSchemeRegistryForTests scoped_registry;
+    url::AddStandardScheme(custom_scheme, url::SchemeType::SCHEME_WITH_HOST);
+    url::AddSecureScheme(custom_scheme);
+    EXPECT_TRUE(IsOriginPotentiallyTrustworthy(custom_scheme_example));
+    EXPECT_TRUE(IsUrlPotentiallyTrustworthy(custom_scheme_example));
+  }
 }
 
 // Tests that were for the removed blink::network_utils::IsOriginSecure.

third_party/blink/renderer/platform/weborigin/security_origin_test.cc

@@ -159,6 +159,8 @@ TEST_F(SecurityOriginTest, IsPotentiallyTrustworthy) {
       {false, false, "http://foobar.com"},
       {false, false, "http://foobar.com:443"},
       {false, false, "ws://foobar.com"},
+      // TODO(crbug.com/1163060): Test registration of secure schemes.
+      {false, false, "custom-scheme://example.com"},
 
       // Local files are considered trustworthy.
       {true, false, "file:///home/foobar/index.html"},
@@ -238,6 +240,7 @@ TEST_F(SecurityOriginTest, IsSecure) {
       {false,
        "filesystem:blob:https://example.com/"
        "578223a1-8c13-17b3-84d5-eca045ae384a"},
+      // TODO(crbug.com/1163060): Test registration of secure schemes.
       {false, "custom-scheme://example.com"},
       {true, "quic-transport://example.com/counter"},
       {false, ""},
@@ -251,12 +254,6 @@ TEST_F(SecurityOriginTest, IsSecure) {
   EXPECT_FALSE(SecurityOrigin::IsSecure(NullURL()));
 }
 
-TEST_F(SecurityOriginTest, IsCustomSchemeSecure) {
-  url::ScopedSchemeRegistryForTests scoped_registry;
-  url::AddSecureScheme("custom-scheme");
-  EXPECT_TRUE(SecurityOrigin::IsSecure(KURL("custom-scheme://example.com")));
-}
-
 TEST_F(SecurityOriginTest, IsSecureViaTrustworthy) {
   // TODO(crbug.com/1153336): Should SecurityOrigin::IsSecure be aligned with
   // network::IsURLPotentiallyTrustworthy?