Do not show mixed form warning for javascript urls

Forms that set their target to a javascript: scheme URL were being
tagged as mixed content, this CL fixes that.

Bug: 1135173
Change-Id: I1b185bef9e1dc41d97736f3a1c96de510fb7eef9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2451510
Commit-Queue: Carlos IL <carlosil@chromium.org>
Commit-Queue: Dominic Battré <battre@chromium.org>
Reviewed-by: Dominic Battré <battre@chromium.org>
Auto-Submit: Carlos IL <carlosil@chromium.org>
Cr-Commit-Position: refs/heads/master@{#815752}

components/autofill/core/browser/autofill_browser_util.cc

@@ -10,11 +10,19 @@
 namespace {
 // Matches the blink check for mixed content.
 bool IsInsecureFormAction(const GURL& action_url) {
-  if (action_url.SchemeIs(url::kBlobScheme) ||
-      action_url.SchemeIs(url::kFileSystemScheme))
+  // blob: and filesystem: URLs never hit the network, and access is restricted
+  // to same-origin contexts, so they are not blocked. Some forms use
+  // javascript URLs to handle submissions in JS, those don't count as mixed
+  // content either.
+  // The data scheme is explicitly allowed in order to match blink's equivalent
+  // check, since IsUrlPotentiallyTrustworthy excludes it.
+  if (action_url.SchemeIs(url::kJavaScriptScheme) ||
+      action_url.SchemeIs(url::kBlobScheme) ||
+      action_url.SchemeIs(url::kFileSystemScheme) ||
+      action_url.SchemeIs(url::kDataScheme)) {
     return false;
-  return !network::IsOriginPotentiallyTrustworthy(
-      url::Origin::Create(action_url));
+  }
+  return !network::IsUrlPotentiallyTrustworthy(action_url);
 }
 }  // namespace
 

components/autofill/core/browser/autofill_manager_unittest.cc

@@ -8664,6 +8664,39 @@ TEST_F(AutofillManagerTestWithMixedForms, GetSuggestions_MixedFormUserTyped) {
   external_delegate_->CheckNoSuggestions(kDefaultPageID);
 }
 
+// Test that we don't treat javascript scheme target URLs as mixed forms.
+// Regression test for crbug.com/1135173
+TEST_F(AutofillManagerTestWithMixedForms, GetSuggestions_JavascriptUrlTarget) {
+  // Set up our form data, using a javascript scheme target URL.
+  FormData form;
+  form.name = ASCIIToUTF16("MyForm");
+  form.url = GURL("https://myform.com/form.html");
+  form.action = GURL("javascript:alert('hello');");
+  FormFieldData field;
+  test::CreateTestFormField("Name on Card", "nameoncard", "", "text", &field);
+  form.fields.push_back(field);
+  GetAutofillSuggestions(form, form.fields[0]);
+
+  // Check there is no warning.
+  EXPECT_FALSE(external_delegate_->on_suggestions_returned_seen());
+}
+
+// Test that we don't treat about:blank target URLs as mixed forms.
+TEST_F(AutofillManagerTestWithMixedForms, GetSuggestions_AboutBlankTarget) {
+  // Set up our form data, using a javascript scheme target URL.
+  FormData form;
+  form.name = ASCIIToUTF16("MyForm");
+  form.url = GURL("https://myform.com/form.html");
+  form.action = GURL("about:blank");
+  FormFieldData field;
+  test::CreateTestFormField("Name on Card", "nameoncard", "", "text", &field);
+  form.fields.push_back(field);
+  GetAutofillSuggestions(form, form.fields[0]);
+
+  // Check there is no warning.
+  EXPECT_FALSE(external_delegate_->on_suggestions_returned_seen());
+}
+
 // Desktop only tests.
 #if !defined(OS_ANDROID) && !defined(OS_IOS)
 class AutofillManagerTestForVirtualCardOption : public AutofillManagerTest {