download from file:/// does not show 'Not Secure' - follow up to 1269

[LaurenWags]

Description

Found while testing #1269

Scenario 3 from test plan on brave/brave-core#597 does not show the unlock icon/'Not Secure' on hover when downloading from text file.

Steps to Reproduce

Download from a file://:

1. Drag and drop a text file onto the browser.
2. Right-click on the content and choose "Save as...".
3. Select destination if asked.
4. Observe download item appear in the download shelf on the bottom of the browser. --> Download item does not show the unlocked lock icon but the origin URL is file:///
5. Point mouse to the download item and wait for the tool tip to appear. --> Tool tip does not contain the words "Not secure"

Actual result:

Download item missing unlock icon:

Hover tool tip does not contain 'Not Secure':

Expected result:

Unlock icon on download item and hover tool tip with 'Not Secure' text

Reproduces how often:

easily

Brave version (chrome://version info)

Brave	0.55.14 Chromium: 70.0.3538.54 (Official Build) beta(64-bit)
Revision	4f8e578b6680574714e9ed3bb9f02922b4dde40d-refs/branch-heads/3538@{#937}
OS	Mac OS X

Reproducible on current release:

• Does it reproduce on brave-browser dev/beta builds? yes reproduced on beta
• Does it reproduce on browser-laptop? n/a

Website problems only:

• Does the issue resolve itself when disabling Brave Shields?
• Is the issue reproducible on the latest version of Chrome?

Additional Information

cc @diracdeltas

[diracdeltas]

this is actually expected behavior; file:/// is considered a secure origin. cc @mkarolin

[srirambv]

Muon showed the same but was late renamed to Local File. brave/browser-laptop#8786. Should probably do the same here as well.

[mkarolin]

Yes, sorry, in the original implementation file:/// wasn't considered a secure source, but then on @diracdeltas' suggestion I switched to using an API function that's more sophisticated than just checking for https. file:/// is considered a secure source by that API (as well as about: and even http://localhost, if you ever test those).

[LaurenWags]

@diracdeltas @mkarolin should scenario 3 on test plan in brave/brave-core#597 be updated?

[mkarolin]

@LaurenWags yes, I'll update.

[mkarolin]

Updated.

[LaurenWags]

thanks - will close this issue out!