Whitelist executables that are trusted in the SafeBrowsing download protection.

chrome/browser/safe_browsing/download_protection_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 
 #include "base/bind.h"
 #include "base/format_macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram.h"
@@ skipping 466 matching lines @@
         const GURL& url = info_.download_url_chain[i];
         if (url.is_valid() && sb_service_->MatchDownloadWhitelistUrl(url)) {
           reason = REASON_WHITELISTED_URL;
           break;
         }
       }
       if (info_.referrer_url.is_valid() && reason == REASON_MAX &&
           sb_service_->MatchDownloadWhitelistUrl(info_.referrer_url)) {
         reason = REASON_WHITELISTED_REFERRER;
       }
-      if (reason != REASON_MAX ||
-          signature_info_.certificate_chain_size() > 0) {
+      if (reason != REASON_MAX || signature_info_.trusted()) {
         UMA_HISTOGRAM_COUNTS("SBClientDownload.SignedOrWhitelistedDownload", 1);
       }
     }
+    if (reason == REASON_MAX && signature_info_.trusted()) {
+      // TODO(noelutz): implement a certificate whitelist and only whitelist
+      // binaries whose certificate match the whitelist.
+      reason = REASON_TRUSTED_EXECUTABLE;
+    }
     if (reason != REASON_MAX) {
       RecordImprovedProtectionStats(reason);
       CheckDigestList();
     } else if (!pingback_enabled_) {
       RecordImprovedProtectionStats(REASON_PING_DISABLED);
       CheckDigestList();
     } else {
       // TODO(noelutz): check signature and CA against whitelist.

[mattm, 2011/11/16 01:38:01]

the new todo seems to overlap with this one

[noelutz, 2011/11/16 01:57:18]

Done.

 
       // The URLFetcher is owned by the UI thread, so post a message to
       // start the pingback.
       BrowserThread::PostTask(
           BrowserThread::UI,
           FROM_HERE,
           base::Bind(&CheckClientDownloadRequest::SendRequest, this));
     }
   }
 
@@ skipping 140 matching lines @@
 
 void DownloadProtectionService::RequestFinished(
     CheckClientDownloadRequest* request) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   std::set<scoped_refptr<CheckClientDownloadRequest> >::iterator it =
       download_requests_.find(request);
   DCHECK(it != download_requests_.end());
   download_requests_.erase(*it);
 }
 }  // namespace safe_browsing