Prevent querying of restricted query values.

chrome/browser/instant/instant_extended_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 
 #include "base/prefs/pref_service.h"
+#include "base/stringprintf.h"
+#include "base/utf_string_conversions.h"
+#include "chrome/browser/autocomplete/autocomplete_match.h"
+#include "chrome/browser/autocomplete/autocomplete_provider.h"
 #include "chrome/browser/favicon/favicon_tab_helper.h"
 #include "chrome/browser/instant/instant_commit_type.h"
 #include "chrome/browser/instant/instant_ntp.h"
 #include "chrome/browser/instant/instant_overlay.h"
 #include "chrome/browser/instant/instant_service.h"
 #include "chrome/browser/instant/instant_service_factory.h"
 #include "chrome/browser/instant/instant_tab.h"
 #include "chrome/browser/instant/instant_test_utils.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/search/search.h"
@@ skipping 805 matching lines @@
   omnibox()->model()->OnKillFocus();
 
   // Wait for the overlay to show.
   observer.Wait();
 
   // Confirm that the overlay has been committed.
   content::WebContents* active_tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   EXPECT_EQ(preview_tab, active_tab);
 }
+
+IN_PROC_BROWSER_TEST_F(InstantExtendedTest, RestrictedItemReadback) {
+  content::WindowedNotificationObserver observer(
+      chrome::NOTIFICATION_INSTANT_SENT_MOST_VISITED_ITEMS,
+      content::NotificationService::AllSources());
+
+  // Initialize Instant.
+  ASSERT_NO_FATAL_FAILURE(SetupInstant());
+  FocusOmniboxAndWaitForInstantSupport();
+
+  // Get a handle to the NTP and the current state of the JS.
+  ASSERT_NE(static_cast<InstantNTP*>(NULL), instant()->ntp());
+  content::WebContents* preview_tab = instant()->ntp()->contents();
+  EXPECT_TRUE(preview_tab);
+  EXPECT_TRUE(UpdateSearchState(preview_tab));
+
+  // Manufacture a few autocomplete results and get them down to the page.
+  std::vector<InstantAutocompleteResult> autocomplete_results;
+  for (int i = 0; i < 3; ++i) {
+    std::string description(base::StringPrintf("Test Description %d", i));
+    std::string url(base::StringPrintf("http://www.testurl%d.com", i));
+
+    InstantAutocompleteResult res;
+    res.provider = ASCIIToUTF16(AutocompleteProvider::TypeToString(
+        AutocompleteProvider::TYPE_BUILTIN));
+    res.type = ASCIIToUTF16(AutocompleteMatch::TypeToString(
+        AutocompleteMatch::SEARCH_WHAT_YOU_TYPED)),
+    res.description = ASCIIToUTF16(description);
+    res.destination_url = ASCIIToUTF16(url);
+    res.transition = content::PAGE_TRANSITION_TYPED;
+    res.relevance = 42 + i;
+
+    autocomplete_results.push_back(res);
+  }
+  instant()->overlay()->SendAutocompleteResults(autocomplete_results);
+
+  const char kQueryString[] = "Hippos go berzerk!";
+
+  // First set the query text to a non restricted value and ensure it can be
+  // read back.
+  std::ostringstream stream;
+  stream << "apiHandle.setValue('" << kQueryString << "');";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+  observer.Wait();
+
+  std::string result;
+  EXPECT_TRUE(GetStringFromJS(instant()->GetPreviewContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ(kQueryString, result);
+
+  // Set the query text to the first restricted autocomplete item.
+  int rid = 0;
+  stream.str(std::string());
+  stream << "apiHandle.setRestrictedValue(" << rid << ")";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+  observer.Wait();
+
+  // Expect that we now receive the empty string when reading the value back.
+  EXPECT_TRUE(GetStringFromJS(instant()->GetPreviewContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ("", result);
+
+  // Now set the query text to a non restricted value and ensure that the
+  // visibility has been reset and the string can again be read back.
+  stream.str(std::string());
+  stream << "apiHandle.setValue('" << kQueryString << "');";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+  observer.Wait();
+
+  EXPECT_TRUE(GetStringFromJS(instant()->GetPreviewContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ(kQueryString, result);
+}