Downgrade page security if an inline has invalid certificate.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 195edc388d7e714b3c4772930b2b099f260654fa..4f34ca6852ee8280c144f193011a722dd2dffc32 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -1881,6 +1881,22 @@ void WebContentsImpl::DragSourceMovedTo(int client_x, int client_y,
 
 void WebContentsImpl::DidGetResourceResponseStart(
   const ResourceRequestDetails& details) {
+
+  // If inline resource has invalid certificate, set the insecure content flag.
+  // See https://codereview.chromium.org/181253003/

[Charlie Reis, 2014/04/10 16:57:19]

No need for this line-- the rest of the summary is sufficient.  (We can always
track down the CL that introduced the comment in revision history.)

+  // For all the intended notifications to be sent, we need to call
+  // SSLManager::NotifySSLInternalStateChanged() after setting the flag.
+  // In "standard" insecure content scenario (i.e. http resource in https
+  // context) the flag is set and SSLManager gets notified in
+  // OnDidDisplayInsecureContent() (Webkit notification handler).
+  // When, however, the certificate for the inline is invalid, Webkit will not
+  // tell us about it and we need to set the flag & notify SSLManager manually.
+  // Note: the call to SSLManager::NotifySSLInternalStateChanged() will be done
+  // from SSLManager::DidStartResourceResponse().

[Charlie Reis, 2014/04/10 16:57:19]

This comment is great.

+  // See SSLPolicyBackend::HostRanInsecureContent()

[Charlie Reis, 2014/04/10 16:57:19]

No need for this line, since it's easy for it to get stale if that
implementation changes.  We just care that DidStartResourceResponse will do it,
as you mention above.

+  if (net::IsCertStatusError(details.ssl_cert_status))
+    displayed_insecure_content_ = true;
+
   controller_.ssl_manager()->DidStartResourceResponse(details);
 
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
@@ -2272,6 +2288,14 @@ void WebContentsImpl::OnDidLoadResourceFromMemoryCache(
       url, GetRenderProcessHost()->GetID(), cert_id, cert_status, http_method,
       mime_type, resource_type);
 
+  // See WebContentsImpl::DidGetResourceResponseStart for an explanation of why
+  // displayed_insecure_content_ is set here.
+  // Note: the call to SSLManager::NotifySSLInternalStateChanged() will be done

[Charlie Reis, 2014/04/10 16:57:19]

No need for these last 3 lines, since they're covered in the comment you
reference.

+  // from SSLManager::DidLoadFromMemoryCache().
+  // See SSLPolicyBackend::HostRanInsecureContent()
+  if (net::IsCertStatusError(cert_status))
+    displayed_insecure_content_ = true;
+
   controller_.ssl_manager()->DidLoadFromMemoryCache(details);
 
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,