WKWebView(iOS9): correctly update SSL status for current navigation item

ios/web/web_state/ui/crw_wk_web_view_web_controller.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_wk_web_view_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #include "base/ios/ios_util.h"
 #include "base/ios/weak_nsobject.h"
 #include "base/json/json_reader.h"
 #import "base/mac/scoped_nsobject.h"
 #include "base/macros.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/values.h"
 #import "ios/net/http_response_headers_util.h"
 #import "ios/web/crw_network_activity_indicator_manager.h"
 #import "ios/web/navigation/crw_session_controller.h"
 #import "ios/web/navigation/crw_session_entry.h"
 #include "ios/web/navigation/navigation_item_impl.h"
 #include "ios/web/navigation/web_load_params.h"
 #import "ios/web/net/crw_cert_verification_controller.h"
 #include "ios/web/public/cert_store.h"
@@ skipping 219 matching lines @@
 // Called when a load ends in an SSL error and certificate chain.
 - (void)handleSSLCertError:(NSError*)error;
 #endif
 
 // Adds an activity indicator tasks for this web controller.
 - (void)addActivityIndicatorTask;
 
 // Clears all activity indicator tasks for this web controller.
 - (void)clearActivityIndicatorTasks;
 
+// Updates |security_style| and |cert_status| for the NavigationItem with ID
+// |navigationItemID|, if URL and certificate chain still match |host| and
+// |certChain|.
+- (void)updateSSLStatusForNavigationItemWithID:(int)navigationItemID
+                                     certChain:(NSArray*)chain
+                                          host:(NSString*)host
+                             withSecurityStyle:(web::SecurityStyle)style
+                                    certStatus:(net::CertStatus)certStatus;
+
+// Asynchronously obtains SSL status from given |certChain| and |host| and
+// updates current navigation item. Before scheduling update changes SSLStatus'
+// cert_status and security_style to default.
+- (void)scheduleSSLStatusUpdateUsingCertChain:(NSArray*)chain
+                                         host:(NSString*)host;
+
 #if !defined(ENABLE_CHROME_NET_STACK_FOR_WKWEBVIEW)
 // Updates SSL status for the current navigation item based on the information
 // provided by web view.
 - (void)updateSSLStatusForCurrentNavigationItem;
 #endif
 
 // Registers load request with empty referrer and link or client redirect
 // transition based on user interaction state.
 - (void)registerLoadRequest:(const GURL&)url;
 
@@ skipping 594 matching lines @@
 - (void)addActivityIndicatorTask {
   [[CRWNetworkActivityIndicatorManager sharedInstance]
       startNetworkTaskForGroup:[self activityIndicatorGroupID]];
 }
 
 - (void)clearActivityIndicatorTasks {
   [[CRWNetworkActivityIndicatorManager sharedInstance]
       clearNetworkTasksForGroup:[self activityIndicatorGroupID]];
 }
 
+- (void)updateSSLStatusForNavigationItemWithID:(int)navigationItemID
+                                     certChain:(NSArray*)chain
+                                          host:(NSString*)host
+                             withSecurityStyle:(web::SecurityStyle)style
+                                    certStatus:(net::CertStatus)certStatus {
+  web::NavigationManager* navigationManager =
+      self.webStateImpl->GetNavigationManager();
+
+  // The searched item almost always be the last one, so walk backward rather
+  // than forward.
+  for (int i = navigationManager->GetEntryCount() - 1; 0 <= i; i--) {
+    web::NavigationItem* item = navigationManager->GetItemAtIndex(i);
+    if (item->GetUniqueID() != navigationItemID)
+      continue;
+
+    // NavigationItem's UniqueID is preserved even after redirects, so
+    // checking that cert and URL match is necessary.
+    scoped_refptr<net::X509Certificate> cert(web::CreateCertFromChain(chain));
+    int certID =
+        web::CertStore::GetInstance()->StoreCert(cert.get(), self.certGroupID);
+    std::string GURLHost = base::SysNSStringToUTF8(host);
+    web::SSLStatus& SSLStatus = item->GetSSL();
+    if (SSLStatus.cert_id == certID && item->GetURL().host() == GURLHost) {
+      web::SSLStatus previousSSLStatus = item->GetSSL();
+      SSLStatus.cert_status = certStatus;
+      SSLStatus.security_style = style;
+      if (navigationManager->GetCurrentEntryIndex() == i &&
+          !previousSSLStatus.Equals(SSLStatus)) {
+        [self didUpdateSSLStatusForCurrentNavigationItem];
+      }
+    }
+    return;
+  }
+}
+
+- (void)scheduleSSLStatusUpdateUsingCertChain:(NSArray*)chain
+                                         host:(NSString*)host {
+  // Use Navigation Item's unique ID to locate requested item after
+  // obtaining cert status asynchronously.
+  int itemID = self.webStateImpl->GetNavigationManager()
+                   ->GetLastCommittedItem()
+                   ->GetUniqueID();
+
+  base::WeakNSObject<CRWWKWebViewWebController> weakSelf(self);
+  void (^SSLStatusResponse)(web::SecurityStyle, net::CertStatus) =
+      ^(web::SecurityStyle style, net::CertStatus certStatus) {
+        base::scoped_nsobject<CRWWKWebViewWebController> strongSelf(
+            [weakSelf retain]);
+        if (!strongSelf || [strongSelf isBeingDestroyed]) {
+          return;
+        }
+        [strongSelf updateSSLStatusForNavigationItemWithID:itemID
+                                                 certChain:chain
+                                                      host:host
+                                         withSecurityStyle:style
+                                                certStatus:certStatus];
+      };
+
+  [_certVerificationController
+      querySSLStatusForTrust:web::CreateServerTrustFromChain(chain, host)
+                        host:host
+           completionHandler:SSLStatusResponse];
+}
+
 #if !defined(ENABLE_CHROME_NET_STACK_FOR_WKWEBVIEW)
+
 - (void)updateSSLStatusForCurrentNavigationItem {
   if ([self isBeingDestroyed])
     return;
 
-  DCHECK(self.webStateImpl);
   web::NavigationItem* item =
       self.webStateImpl->GetNavigationManagerImpl().GetLastCommittedItem();
   if (!item)
     return;
 
   web::SSLStatus previousSSLStatus = item->GetSSL();
-  web::SSLStatus& SSLStatus = item->GetSSL();
+
+  // Starting from iOS9 WKWebView blocks active mixed content, so if
+  // |hasOnlySecureContent| returns NO it means passive content.
+  item->GetSSL().content_status =
+      [_wkWebView hasOnlySecureContent]
+          ? web::SSLStatus::NORMAL_CONTENT
+          : web::SSLStatus::DISPLAYED_INSECURE_CONTENT;
+
+  // Try updating SSLStatus for current NavigationItem asynchronously.
+  scoped_refptr<net::X509Certificate> cert;
   if (item->GetURL().SchemeIsCryptographic()) {
-    // TODO(eugenebut): Do not set security style to authenticated once
-    // proceeding with bad ssl cert is implemented.
-    SSLStatus.security_style = web::SECURITY_STYLE_AUTHENTICATED;
-    SSLStatus.content_status = [_wkWebView hasOnlySecureContent]
-                                   ? web::SSLStatus::NORMAL_CONTENT
-                                   : web::SSLStatus::DISPLAYED_INSECURE_CONTENT;
+    NSArray* chain = [_wkWebView certificateChain];
+    cert = web::CreateCertFromChain(chain);
+    if (cert) {
+      int oldCertID = item->GetSSL().cert_id;
+      std::string oldHost = item->GetSSL().cert_status_host;
+      item->GetSSL().cert_id = web::CertStore::GetInstance()->StoreCert(
+          cert.get(), self.certGroupID);
+      item->GetSSL().cert_status_host = _documentURL.host();
+      // Only recompute the SSLStatus information if the certificate or host has
+      // since changed. Host can be changed in case of redirect.
+      if (oldCertID != item->GetSSL().cert_id ||
+          oldHost != item->GetSSL().cert_status_host) {
+        // Real SSL status is unknown, reset cert status and security style.
+        // they will be asynchronously updated in

[davidben, 2015/10/16 00:15:20]

they -> They

[Eugene But (OOO till 7-30), 2015/10/16 02:25:35]

Done.

+        // |scheduleSSLStatusUpdateUsingCertChain|.
+        item->GetSSL().cert_status = net::CertStatus();
+        item->GetSSL().security_style = web::SECURITY_STYLE_UNKNOWN;
 
-    if (base::ios::IsRunningOnIOS9OrLater()) {
-      scoped_refptr<net::X509Certificate> cert(web::CreateCertFromChain(
-          [_wkWebView performSelector:@selector(certificateChain)]));
-      if (cert) {
-        SSLStatus.cert_id = web::CertStore::GetInstance()->StoreCert(
-            cert.get(), self.certGroupID);
-      } else {
-        SSLStatus.security_style = web::SECURITY_STYLE_UNAUTHENTICATED;
-        SSLStatus.cert_id = 0;
+        NSString* host = base::SysUTF8ToNSString(_documentURL.host());
+        [self scheduleSSLStatusUpdateUsingCertChain:chain host:host];
       }
     }
-  } else {
-    SSLStatus.security_style = web::SECURITY_STYLE_UNAUTHENTICATED;
-    SSLStatus.cert_id = 0;
   }
 
-  if (!previousSSLStatus.Equals(SSLStatus)) {
+  if (!cert) {
+    item->GetSSL().cert_id = 0;
+    if (!item->GetURL().SchemeIsCryptographic()) {
+      // HTTP or other non-secure connection.
+      item->GetSSL().security_style = web::SECURITY_STYLE_UNAUTHENTICATED;
+    } else {
+      // HTTPS, no certificate (this use-case has not been observed).
+      item->GetSSL().security_style = web::SECURITY_STYLE_UNKNOWN;
+    }
+  }
+
+  if (!previousSSLStatus.Equals(item->GetSSL())) {
     [self didUpdateSSLStatusForCurrentNavigationItem];
   }
 }
+
 #endif  // !defined(ENABLE_CHROME_NET_STACK_FOR_WKWEBVIEW)
 
 - (void)registerLoadRequest:(const GURL&)url {
   // If load request is registered via WKWebViewWebController, assume transition
   // is link or client redirect as other transitions will already be registered
   // by web controller or delegates.
   // TODO(stuartmorgan): Remove guesswork and replace with information from
   // decidePolicyForNavigationAction:.
   ui::PageTransition transition = self.userInteractionRegistered
                                       ? ui::PAGE_TRANSITION_LINK
                                       : ui::PAGE_TRANSITION_CLIENT_REDIRECT;
   // The referrer is not known yet, and will be updated later.
   const web::Referrer emptyReferrer;
   [self registerLoadRequest:url referrer:emptyReferrer transition:transition];
 }
 
 - (void)URLDidChangeWithoutDocumentChange:(const GURL&)newURL {
   DCHECK(newURL == net::GURLWithNSURL([_wkWebView URL]));
+  DCHECK_EQ(_documentURL.host(), newURL.host());
   _documentURL = newURL;
   // If called during window.history.pushState or window.history.replaceState
   // JavaScript evaluation, only update the document URL. This callback does not
   // have any information about the state object and cannot create (or edit) the
   // navigation entry for this page change. Web controller will sync with
   // history changes when a window.history.didPushState or
   // window.history.didReplaceState message is received, which should happen in
   // the next runloop.
   if (!_changingHistoryState) {
     [self registerLoadRequest:_documentURL];
@@ skipping 413 matching lines @@
   // This is the point where the document's URL has actually changed.
   _documentURL = net::GURLWithNSURL([_wkWebView URL]);
   DCHECK(_documentURL == self.lastRegisteredRequestURL);
   [self webPageChanged];
 
   [self updateCurrentBackForwardListItemHolder];
 
 #if !defined(ENABLE_CHROME_NET_STACK_FOR_WKWEBVIEW)
   [self updateSSLStatusForCurrentNavigationItem];
 #endif
+
+  // Report cases where SSL cert is missing for a secure connection.
+  if (_documentURL.SchemeIsCryptographic()) {
+    scoped_refptr<net::X509Certificate> cert =
+        web::CreateCertFromChain([_wkWebView certificateChain]);
+    UMA_HISTOGRAM_BOOLEAN("WebController.WKWebViewHasCertForSecureConnection",
+                          cert);
+  }
 }
 
 - (void)webView:(WKWebView *)webView
     didFinishNavigation:(WKNavigation *)navigation {
   DCHECK(!self.isHalted);
   // Trigger JavaScript driven post-document-load-completion tasks.
   // TODO(jyquinn): Investigate using WKUserScriptInjectionTimeAtDocumentEnd to
   // inject this material at the appropriate time rather than invoking here.
   web::EvaluateJavaScript(webView,
                           @"__gCrWeb.didFinishNavigation()", nil);
@@ skipping 13 matching lines @@
         (void (^)(NSURLSessionAuthChallengeDisposition disposition,
                   NSURLCredential *credential))completionHandler {
   if (![challenge.protectionSpace.authenticationMethod
           isEqual:NSURLAuthenticationMethodServerTrust]) {
     completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
     return;
   }
 
   SecTrustRef trust = challenge.protectionSpace.serverTrust;
   scoped_refptr<net::X509Certificate> cert = web::CreateCertFromTrust(trust);
+  // TODO(eugenebut): pass SecTrustRef instead of cert.
   [_certVerificationController
       decidePolicyForCert:cert
                      host:challenge.protectionSpace.host
         completionHandler:^(web::CertAcceptPolicy policy,
                             net::CertStatus status) {
           completionHandler(NSURLSessionAuthChallengeRejectProtectionSpace,
                             nil);
         }];
 }
 
@@ skipping 86 matching lines @@
                               placeholderText:defaultText
                                    requestURL:
             net::GURLWithNSURL(frame.request.URL)
                             completionHandler:completionHandler];
   } else if (completionHandler) {
     completionHandler(nil);
   }
 }
 
 @end