Display when PKP is bypassed in devtools

third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js

Index: third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
diff --git a/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js b/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
index 63927d4d4080cb57572d6265fb4114e38034ef87..8315651718a4728839df5300c9a355962d402e32 100644
--- a/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
@@ -65,11 +65,12 @@ WebInspector.SecurityPanel.prototype = {
      * @param {!Array<!SecurityAgent.SecurityStateExplanation>} explanations
      * @param {?SecurityAgent.MixedContentStatus} mixedContentStatus
      * @param {boolean} schemeIsCryptographic
+     * @param {boolean} pkpBypassed
      */
-    _updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic)
+    _updateSecurityState: function(newSecurityState, mixedContentStatus, schemeIsCryptographic, pkpBypassed, explanations)
     {
         this._sidebarMainViewElement.setSecurityState(newSecurityState);
-        this._mainView.updateSecurityState(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic);
+        this._mainView.updateSecurityState(newSecurityState, mixedContentStatus, schemeIsCryptographic, pkpBypassed, explanations);
     },
 
     /**
@@ -79,10 +80,11 @@ WebInspector.SecurityPanel.prototype = {
     {
         var data = /** @type {!WebInspector.PageSecurityState} */ (event.data);
         var securityState = /** @type {!SecurityAgent.SecurityState} */ (data.securityState);
-        var explanations = /** @type {!Array<!SecurityAgent.SecurityStateExplanation>} */ (data.explanations);
         var mixedContentStatus = /** @type {?SecurityAgent.MixedContentStatus} */ (data.mixedContentStatus);
         var schemeIsCryptographic = /** @type {boolean} */ (data.schemeIsCryptographic);
-        this._updateSecurityState(securityState, explanations, mixedContentStatus, schemeIsCryptographic);
+        var pkpBypassed = /** @type {boolean} */ (data.pkpBypassed);
+        var explanations = /** @type {!Array<!SecurityAgent.SecurityStateExplanation>} */ (data.explanations);
+        this._updateSecurityState(securityState, mixedContentStatus, schemeIsCryptographic, pkpBypassed, explanations);
     },
 
     selectAndSwitchToMainView: function()
@@ -594,11 +596,12 @@ WebInspector.SecurityMainView.prototype = {
 
     /**
      * @param {!SecurityAgent.SecurityState} newSecurityState
-     * @param {!Array<!SecurityAgent.SecurityStateExplanation>} explanations
      * @param {?SecurityAgent.MixedContentStatus} mixedContentStatus
      * @param {boolean} schemeIsCryptographic
+     * @param {boolean} pkpBypassed
+     * @param {!Array<!SecurityAgent.SecurityStateExplanation>} explanations
      */
-    updateSecurityState: function(newSecurityState, explanations, mixedContentStatus, schemeIsCryptographic)
+    updateSecurityState: function(newSecurityState, mixedContentStatus, schemeIsCryptographic, pkpBypassed, explanations)
     {
         // Remove old state.
         // It's safe to call this even when this._securityState is undefined.
@@ -618,6 +621,7 @@ WebInspector.SecurityMainView.prototype = {
         this._explanations = explanations,
         this._mixedContentStatus = mixedContentStatus;
         this._schemeIsCryptographic = schemeIsCryptographic;
+        this._pkpBypassed = pkpBypassed;
 
         this._panel.setRanInsecureContentStyle(mixedContentStatus.ranInsecureContentStyle);
         this._panel.setDisplayedInsecureContentStyle(mixedContentStatus.displayedInsecureContentStyle);
@@ -632,8 +636,21 @@ WebInspector.SecurityMainView.prototype = {
             this._addExplanation(explanation);
 
         this._addMixedContentExplanations();
+        this._addPKPBypassExplanations();
     },
 
+    _addPKPBypassExplanations: function()
+    {
+        if (!this._pkpBypassed)
+            return;
+
+        this._addExplanation(/** @type {!SecurityAgent.SecurityStateExplanation} */ ({
+            "securityState": SecurityAgent.SecurityState.Info,
+            "summary": WebInspector.UIString("Public-Key Pinning"),

[lgarron, 2016/07/06 22:19:43]

Could you change this to "Public-Key Pinning Bypassed"?

The screenshot made me realize the summary implies that PKP is active, but we
only show it when it is *not* active. I'd rather have us be as clear as
possible.

[dadrian, 2016/07/07 00:59:06]

Done.

+            "description": WebInspector.UIString("Public-key pinning was bypassed by a local root certificate.")
+        }));
+      },
+
     _addMixedContentExplanations: function()
     {
         if (!this._schemeIsCryptographic)