Display when PKP is bypassed in devtools

third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @constructor
  * @extends {WebInspector.PanelWithSidebar}
  * @implements {WebInspector.TargetManager.Observer}
  */
 WebInspector.SecurityPanel = function()
@@ skipping 47 matching lines @@
     setDisplayedInsecureContentStyle: function(securityState)
     {
         this._displayedInsecureContentStyle = securityState;
     },
 
     /**
      * @param {!SecurityAgent.SecurityState} newSecurityState
      * @param {!Array<!SecurityAgent.SecurityStateExplanation>} explanations
      * @param {?SecurityAgent.MixedContentStatus} mixedContentStatus
      * @param {boolean} schemeIsCryptographic
+     * @param {boolean} pkpBypassed
      */
-    _updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic)
+    _updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic, pkpBypassed)
     {
         this._sidebarMainViewElement.setSecurityState(newSecurityState);
-        this._mainView.updateSecurityState(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic);
+        this._mainView.updateSecurityState(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic, pkpBypassed);
     },
 
     /**
      * @param {!WebInspector.Event} event
      */
     _onSecurityStateChanged: function(event)
     {
         var data = /** @type {!WebInspector.PageSecurityState} */ (event.data);
         var securityState = /** @type {!SecurityAgent.SecurityState} */ (data.securityState);
         var explanations = /** @type {!Array<!SecurityAgent.SecurityStateExplanation>} */ (data.explanations);
         var mixedContentStatus = /** @type {?SecurityAgent.MixedContentStatus} */ (data.mixedContentStatus);
         var schemeIsCryptographic = /** @type {boolean} */ (data.schemeIsCryptographic);
-        this._updateSecurityState(securityState, explanations, mixedContentStatus, schemeIsCryptographic);
+        var pkpBypassed = /** @type {boolean} */ (data.pkpBypassed);
+        this._updateSecurityState(securityState, explanations, mixedContentStatus, schemeIsCryptographic, pkpBypassed);
     },
 
     selectAndSwitchToMainView: function()
     {
         // The sidebar element will trigger displaying the main view. Rather than making a redundant call to display the main view, we rely on this.
         this._sidebarMainViewElement.select();
     },
     /**
      * @param {!WebInspector.SecurityPanel.Origin} origin
      */
@@ skipping 494 matching lines @@
         }
 
         return text;
     },
 
     /**
      * @param {!SecurityAgent.SecurityState} newSecurityState
      * @param {!Array<!SecurityAgent.SecurityStateExplanation>} explanations
      * @param {?SecurityAgent.MixedContentStatus} mixedContentStatus
      * @param {boolean} schemeIsCryptographic
+     * @param {boolean} pkpBypassed
      */
-    updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic)
+    updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic, pkpBypassed)
     {
         // Remove old state.
         // It's safe to call this even when this._securityState is undefined.
         this._summarySection.classList.remove("security-summary-" + this._securityState);
 
         // Add new state.
         this._securityState = newSecurityState;
         this._summarySection.classList.add("security-summary-" + this._securityState);
         var summaryExplanationStrings = {
             "unknown":  WebInspector.UIString("The security of this page is unknown."),
             "insecure": WebInspector.UIString("This page is insecure (broken HTTPS)."),
             "neutral":  WebInspector.UIString("This page is not secure."),
             "secure":   WebInspector.UIString("This page is secure (valid HTTPS).")
         }
+        var pkpBypassedExplanation = WebInspector.UIString("Public-key pinning was bypassed by a local root certificate.");

[lgarron, 2016/07/01 01:33:39]

Unused? (It seems to be hardcoded separately below. We should make sure stuff is
DRY.)

[dadrian, 2016/07/01 01:58:45]

Whoops, Done.

         this._summaryText.textContent = summaryExplanationStrings[this._securityState];
 
         this._explanations = explanations,
         this._mixedContentStatus = mixedContentStatus;
         this._schemeIsCryptographic = schemeIsCryptographic;
+        this._pkpBypassed = pkpBypassed;
 
         this._panel.setRanInsecureContentStyle(mixedContentStatus.ranInsecureContentStyle);
         this._panel.setDisplayedInsecureContentStyle(mixedContentStatus.displayedInsecureContentStyle);
 
         this.refreshExplanations();
     },
 
     refreshExplanations: function()
     {
         this._securityExplanations.removeChildren();
         for (var explanation of this._explanations)
             this._addExplanation(explanation);
 
         this._addMixedContentExplanations();
+        this._addPKPBypassExplanations();
     },
 
+    _addPKPBypassExplanations: function()
+    {
+        if (!this._pkpBypassed)
+            return;
+
+        this._addExplanation(/** @type {!SecurityAgent.SecurityStateExplanation} */ ({
+            "securityState": SecurityAgent.SecurityState.Info,
+            "summary": WebInspector.UIString("Public-Key Pinning"),
+            "description": WebInspector.UIString("Public-key pinning was bypassed by a local root certificate.")
+        }));
+      },
+
     _addMixedContentExplanations: function()
     {
         if (!this._schemeIsCryptographic)
             return;
 
         if (this._mixedContentStatus && (this._mixedContentStatus.ranInsecureContent || this._mixedContentStatus.displayedInsecureContent)) {
             if (this._mixedContentStatus.ranInsecureContent)
                 this._addMixedContentExplanation(this._mixedContentStatus.ranInsecureContentStyle, WebInspector.UIString("Active Mixed Content"), WebInspector.UIString("You have recently allowed insecure content (such as scripts or iframes) to run on this site."), WebInspector.NetworkLogView.MixedContentFilterValues.BlockOverridden, showBlockOverriddenMixedContentInNetworkPanel);
             if (this._mixedContentStatus.displayedInsecureContent)
                 this._addMixedContentExplanation(this._mixedContentStatus.displayedInsecureContentStyle, WebInspector.UIString("Mixed Content"), WebInspector.UIString("The site includes HTTP resources."), WebInspector.NetworkLogView.MixedContentFilterValues.Displayed, showDisplayedMixedContentInNetworkPanel);
@@ skipping 342 matching lines @@
         row.createChild("div").textContent = key;
 
         var valueDiv = row.createChild("div");
         if (typeof value === "string") {
             valueDiv.textContent = value;
         } else {
             valueDiv.appendChild(value);
         }
     }
 }