Fix 58162: Mixed Content False Positive for intranet hostname certificates...

chrome/browser/ssl/ssl_policy.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_policy.h"
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/singleton.h"
 #include "base/string_piece.h"
@@ skipping 14 matching lines @@
 #include "chrome/common/notification_service.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/time_format.h"
 #include "chrome/common/url_constants.h"
 #include "grit/browser_resources.h"
 #include "grit/generated_resources.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/ssl_info.h"
 #include "webkit/glue/resource_type.h"
 
+namespace {
+
+static const char kDot = '.';
+
+static bool IsIntranetHost(const std::string& host) {
+  const size_t dot = host.find(kDot);
+  return dot == std::string::npos || dot == host.length() - 1;
+}
+
+}  // namespace
+
 SSLPolicy::SSLPolicy(SSLPolicyBackend* backend)
     : backend_(backend) {
   DCHECK(backend_);
 }
 
 void SSLPolicy::OnCertError(SSLCertErrorHandler* handler) {
   // First we check if we know the policy for this error.
   net::CertPolicy::Judgment judgment =
       backend_->QueryPolicy(handler->ssl_info().cert,
                             handler->request_url().host());
@@ skipping 99 matching lines @@
     return;
 
   // An HTTPS response may not have a certificate for some reason.  When that
   // happens, use the unauthenticated (HTTP) rather than the authentication
   // broken security style so that we can detect this error condition.
   if (!entry->ssl().cert_id()) {
     entry->ssl().set_security_style(SECURITY_STYLE_UNAUTHENTICATED);
     return;
   }
 
+  if (!(entry->ssl().cert_status() & net::CERT_STATUS_COMMON_NAME_INVALID)) {
+    // CAs issue certificates for intranet hosts to everyone.  Therefore, we
+    // mark intranet hosts as being non-unique.
+    if (IsIntranetHost(entry->url().host())) {
+      entry->ssl().set_cert_status(entry->ssl().cert_status() |
+                                   net::CERT_STATUS_NON_UNIQUE_NAME);
+    }
+  }
+
   // If CERT_STATUS_UNABLE_TO_CHECK_REVOCATION is the only certificate error,
   // don't lower the security style to SECURITY_STYLE_AUTHENTICATION_BROKEN.
   int cert_errors = entry->ssl().cert_status() & net::CERT_STATUS_ALL_ERRORS;
   if (cert_errors) {
     if (cert_errors != net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION)
       entry->ssl().set_security_style(SECURITY_STYLE_AUTHENTICATION_BROKEN);
     return;
   }
 
   SiteInstance* site_instance = entry->site_instance();
@@ skipping 72 matching lines @@
 
   entry->ssl().set_security_style(entry->url().SchemeIsSecure() ?
       SECURITY_STYLE_AUTHENTICATED : SECURITY_STYLE_UNAUTHENTICATED);
 }
 
 void SSLPolicy::OriginRanInsecureContent(const std::string& origin, int pid) {
   GURL parsed_origin(origin);
   if (parsed_origin.SchemeIsSecure())
     backend_->HostRanInsecureContent(parsed_origin.host(), pid);
 }