[Passwords] Don't replace federation:// in HttpPasswordStoreMigrator

This change modifies HttpPasswordStoreMigrator to not replace the
signon_realm if the previous signon_realm did not have a HTTP scheme.
While rare, this scenario can happen for federated credentials that have
been saved on a secure HTTP origin, such as http://localhost.

Bug: 687968
Change-Id: Ib777aac0aadd1ca39723de40b40fd75193954f7e
Reviewed-on: https://chromium-review.googlesource.com/c/1346458
Commit-Queue: Jan Wilken Dörrie <jdoerrie@chromium.org>
Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#610134}

components/password_manager/core/browser/http_password_store_migrator.cc

@@ -9,6 +9,7 @@
 
 #include "base/memory/weak_ptr.h"
 #include "base/stl_util.h"
+#include "base/strings/strcat.h"
 #include "components/password_manager/core/browser/password_manager_client.h"
 #include "components/password_manager/core/browser/password_manager_metrics_util.h"
 #include "components/password_manager/core/browser/password_manager_util.h"
@@ -63,11 +64,15 @@ autofill::PasswordForm HttpPasswordStoreMigrator::MigrateHttpFormToHttps(
   GURL::Replacements rep;
   rep.SetSchemeStr(url::kHttpsScheme);
   https_form.origin = http_form.origin.ReplaceComponents(rep);
-  https_form.signon_realm =
-      std::string(url::kHttpsScheme) +
-      std::string(url::kStandardSchemeSeparator) +
-      std::string(
-          password_manager_util::GetSignonRealmWithProtocolExcluded(http_form));
+
+  // Only replace the scheme of the signon_realm in case it is HTTP. Do not
+  // change the signon_realm for federated credentials.
+  if (GURL(http_form.signon_realm).SchemeIs(url::kHttpScheme)) {
+    https_form.signon_realm =
+        base::StrCat({url::kHttpsScheme, url::kStandardSchemeSeparator,
+                      password_manager_util::GetSignonRealmWithProtocolExcluded(
+                          https_form)});
+  }
   // If |action| is not HTTPS then it's most likely obsolete. Otherwise, it
   // may still be valid.
   if (!http_form.action.SchemeIs(url::kHttpsScheme))

components/password_manager/core/browser/http_password_store_migrator_unittest.cc

@@ -62,6 +62,18 @@ PasswordForm CreateAndroidCredential() {
   return form;
 }
 
+// Creates a local federated credential.
+PasswordForm CreateLocalFederatedCredential() {
+  PasswordForm form;
+  form.username_value = base::ASCIIToUTF16("user4");
+  form.signon_realm = "federation://localhost/federation.example.com";
+  form.origin = GURL("http://localhost/");
+  form.action = GURL("http://localhost/");
+  form.federation_origin =
+      url::Origin::Create(GURL("https://federation.example.com"));
+  return form;
+}
+
 class MockConsumer : public HttpPasswordStoreMigrator::Consumer {
  public:
   MOCK_METHOD1(ProcessForms,
@@ -174,17 +186,27 @@ void HttpPasswordStoreMigratorTest::TestFullStore(bool is_hsts) {
   PasswordForm form = CreateTestForm();
   PasswordForm psl_form = CreateTestPSLForm();
   PasswordForm android_form = CreateAndroidCredential();
+  PasswordForm federated_form = CreateLocalFederatedCredential();
   PasswordForm expected_form = form;
   expected_form.origin = GURL(kTestHttpsURL);
   expected_form.signon_realm = expected_form.origin.GetOrigin().spec();
 
+  PasswordForm expected_federated_form = federated_form;
+  expected_federated_form.origin = GURL("https://localhost");
+  expected_federated_form.action = GURL("https://localhost");
+
   EXPECT_CALL(store(), AddLogin(expected_form));
+  EXPECT_CALL(store(), AddLogin(expected_federated_form));
   EXPECT_CALL(store(), RemoveLogin(form)).Times(is_hsts);
-  EXPECT_CALL(consumer(), ProcessForms(ElementsAre(Pointee(expected_form))));
+  EXPECT_CALL(store(), RemoveLogin(federated_form)).Times(is_hsts);
+  EXPECT_CALL(consumer(),
+              ProcessForms(ElementsAre(Pointee(expected_form),
+                                       Pointee(expected_federated_form))));
   std::vector<std::unique_ptr<autofill::PasswordForm>> results;
   results.push_back(std::make_unique<PasswordForm>(psl_form));
   results.push_back(std::make_unique<PasswordForm>(form));
   results.push_back(std::make_unique<PasswordForm>(android_form));
+  results.push_back(std::make_unique<PasswordForm>(federated_form));
   migrator.OnGetPasswordStoreResults(std::move(results));
 }