Downgrade page security if an inline has invalid certificate.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 1863 matching lines @@
   if (browser_plugin_embedder_.get())
     browser_plugin_embedder_->DragSourceMovedTo(client_x, client_y,
                                                 screen_x, screen_y);
   if (GetRenderViewHost())
     GetRenderViewHostImpl()->DragSourceMovedTo(client_x, client_y,
                                                screen_x, screen_y);
 }
 
 void WebContentsImpl::DidGetResourceResponseStart(
   const ResourceRequestDetails& details) {
+
+  // If inline resource has invalid certificate, set the insecure content flag.
+  // See https://codereview.chromium.org/181253003/

[Charlie Reis, 2014/04/10 16:57:19]

No need for this line-- the rest of the summary is sufficient.  (We can always
track down the CL that introduced the comment in revision history.)

+  // For all the intended notifications to be sent, we need to call
+  // SSLManager::NotifySSLInternalStateChanged() after setting the flag.
+  // In "standard" insecure content scenario (i.e. http resource in https
+  // context) the flag is set and SSLManager gets notified in
+  // OnDidDisplayInsecureContent() (Webkit notification handler).
+  // When, however, the certificate for the inline is invalid, Webkit will not
+  // tell us about it and we need to set the flag & notify SSLManager manually.
+  // Note: the call to SSLManager::NotifySSLInternalStateChanged() will be done
+  // from SSLManager::DidStartResourceResponse().

[Charlie Reis, 2014/04/10 16:57:19]

This comment is great.

+  // See SSLPolicyBackend::HostRanInsecureContent()

[Charlie Reis, 2014/04/10 16:57:19]

No need for this line, since it's easy for it to get stale if that
implementation changes.  We just care that DidStartResourceResponse will do it,
as you mention above.

+  if (net::IsCertStatusError(details.ssl_cert_status))
+    displayed_insecure_content_ = true;
+
   controller_.ssl_manager()->DidStartResourceResponse(details);
 
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     DidGetResourceResponseStart(details));
 
   // TODO(avi): Remove. http://crbug.com/170921
   NotificationService::current()->Notify(
       NOTIFICATION_RESOURCE_RESPONSE_STARTED,
       Source<WebContents>(this),
       Details<const ResourceRequestDetails>(&details));
@@ skipping 371 matching lines @@
   int connection_status = 0;
   SignedCertificateTimestampIDStatusList signed_certificate_timestamp_ids;
   DeserializeSecurityInfo(security_info, &cert_id, &cert_status,
                           &security_bits, &connection_status,
                           &signed_certificate_timestamp_ids);
   // TODO(alcutter,eranm): Pass signed_certificate_timestamp_ids into details
   LoadFromMemoryCacheDetails details(
       url, GetRenderProcessHost()->GetID(), cert_id, cert_status, http_method,
       mime_type, resource_type);
 
+  // See WebContentsImpl::DidGetResourceResponseStart for an explanation of why
+  // displayed_insecure_content_ is set here.
+  // Note: the call to SSLManager::NotifySSLInternalStateChanged() will be done

[Charlie Reis, 2014/04/10 16:57:19]

No need for these last 3 lines, since they're covered in the comment you
reference.

+  // from SSLManager::DidLoadFromMemoryCache().
+  // See SSLPolicyBackend::HostRanInsecureContent()
+  if (net::IsCertStatusError(cert_status))
+    displayed_insecure_content_ = true;
+
   controller_.ssl_manager()->DidLoadFromMemoryCache(details);
 
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                     DidLoadResourceFromMemoryCache(details));
 
   if (url.is_valid() && url.SchemeIsHTTPOrHTTPS()) {
     scoped_refptr<net::URLRequestContextGetter> request_context(
         resource_type == ResourceType::MEDIA ?
             GetBrowserContext()->GetMediaRequestContextForRenderProcess(
                 GetRenderProcessHost()->GetID()) :
@@ skipping 1345 matching lines @@
 
 void WebContentsImpl::OnPreferredSizeChanged(const gfx::Size& old_size) {
   if (!delegate_)
     return;
   const gfx::Size new_size = GetPreferredSize();
   if (new_size != old_size)
     delegate_->UpdatePreferredSize(this, new_size);
 }
 
 }  // namespace content