Teach SecurityStateModel about subresources with cert errors

components/security_state/security_state_model.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/security_state_model.h"
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
@@ skipping 54 matching lines @@
   static const int64_t kJanuary2017 = INT64_C(13127702400000000);
   if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017))
     return SecurityStateModel::DEPRECATED_SHA1_MAJOR;
   static const int64_t kJanuary2016 = INT64_C(13096080000000000);
   if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016))
     return SecurityStateModel::DEPRECATED_SHA1_MINOR;
 
   return SecurityStateModel::NO_DEPRECATED_SHA1;
 }
 
-SecurityStateModel::ContentStatus GetMixedContentStatus(
-    const SecurityStateModel::VisibleSecurityState& visible_security_state) {
-  bool ran_insecure_content = visible_security_state.ran_mixed_content;
-  bool displayed_insecure_content =
-      visible_security_state.displayed_mixed_content;
-  if (ran_insecure_content && displayed_insecure_content)
+SecurityStateModel::ContentStatus GetContentStatus(bool displayed, bool ran) {
+  if (ran && displayed)
     return SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN;
-  if (ran_insecure_content)
+  if (ran)
     return SecurityStateModel::CONTENT_STATUS_RAN;
-  if (displayed_insecure_content)
+  if (displayed)
     return SecurityStateModel::CONTENT_STATUS_DISPLAYED;
-
   return SecurityStateModel::CONTENT_STATUS_NONE;
 }
 
 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest(
     const SecurityStateModel::VisibleSecurityState& visible_security_state,
     SecurityStateModelClient* client,
     const scoped_refptr<net::X509Certificate>& cert,
     SecurityStateModel::SHA1DeprecationStatus sha1_status,
-    SecurityStateModel::ContentStatus mixed_content_status) {
+    SecurityStateModel::ContentStatus mixed_content_status,
+    SecurityStateModel::ContentStatus content_with_cert_errors_status) {
   DCHECK(visible_security_state.initialized);
   GURL url = visible_security_state.url;
   switch (visible_security_state.initial_security_level) {
     case SecurityStateModel::NONE: {
       if (!client->IsOriginSecure(url) && url.IsStandard())
         return GetSecurityLevelForNonSecureFieldTrial();
       return SecurityStateModel::NONE;
     }
 
     case SecurityStateModel::SECURITY_ERROR:
       return SecurityStateModel::SECURITY_ERROR;
 
     case SecurityStateModel::SECURITY_WARNING:
     case SecurityStateModel::SECURITY_POLICY_WARNING:
       return visible_security_state.initial_security_level;
 
     case SecurityStateModel::SECURE:
     case SecurityStateModel::EV_SECURE: {
       // Major cert errors and active mixed content will generally be
       // downgraded by the embedder to SECURITY_ERROR and handled above,
       // but downgrade here just in case.
       net::CertStatus cert_status = visible_security_state.cert_status;
       if (net::IsCertStatusError(cert_status) &&
           !net::IsCertStatusMinorError(cert_status)) {
         return SecurityStateModel::SECURITY_ERROR;
       }
       if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_RAN ||
           mixed_content_status ==
+              SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN ||
+          content_with_cert_errors_status ==
+              SecurityStateModel::CONTENT_STATUS_RAN ||
+          content_with_cert_errors_status ==
               SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN) {
         return SecurityStateModel::kRanInsecureContentLevel;
       }
 
       // Report if there is a policy cert first, before reporting any other
       // authenticated-but-with-errors cases. A policy cert is a strong
       // indicator of a MITM being present (the enterprise), while the
       // other authenticated-but-with-errors indicate something may
       // be wrong, or may be wrong in the future, but is unclear now.
       if (client->UsedPolicyInstalledCertificate())
         return SecurityStateModel::SECURITY_POLICY_WARNING;
 
       if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR)
         return SecurityStateModel::SECURITY_ERROR;
       if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR)
         return SecurityStateModel::NONE;
 
       // Active mixed content is handled above.
       DCHECK_NE(SecurityStateModel::CONTENT_STATUS_RAN, mixed_content_status);
       DCHECK_NE(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN,
                 mixed_content_status);
-      if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_DISPLAYED)
+      if (mixed_content_status ==
+              SecurityStateModel::CONTENT_STATUS_DISPLAYED ||
+          content_with_cert_errors_status ==
+              SecurityStateModel::CONTENT_STATUS_DISPLAYED)
         return SecurityStateModel::kDisplayedInsecureContentLevel;
 
       if (net::IsCertStatusError(cert_status)) {
         // Major cert errors are handled above.
         DCHECK(net::IsCertStatusMinorError(cert_status));
         return SecurityStateModel::NONE;
       }
       if (net::SSLConnectionStatusToVersion(
               visible_security_state.connection_status) ==
           net::SSL_CONNECTION_VERSION_SSL3) {
@@ skipping 15 matching lines @@
     const scoped_refptr<net::X509Certificate>& cert,
     SecurityStateModel::SecurityInfo* security_info) {
   if (!visible_security_state.initialized) {
     *security_info = SecurityStateModel::SecurityInfo();
     return;
   }
   security_info->cert_id = visible_security_state.cert_id;
   security_info->sha1_deprecation_status =
       GetSHA1DeprecationStatus(cert, visible_security_state);
   security_info->mixed_content_status =
-      GetMixedContentStatus(visible_security_state);
+      GetContentStatus(visible_security_state.displayed_mixed_content,
+                       visible_security_state.ran_mixed_content);
+  security_info->content_with_cert_errors_status = GetContentStatus(
+      visible_security_state.displayed_content_with_cert_errors,
+      visible_security_state.ran_content_with_cert_errors);
   security_info->security_bits = visible_security_state.security_bits;
   security_info->connection_status = visible_security_state.connection_status;
   security_info->cert_status = visible_security_state.cert_status;
   security_info->scheme_is_cryptographic =
       visible_security_state.url.SchemeIsCryptographic();
   security_info->pkp_bypassed = visible_security_state.pkp_bypassed;
   security_info->is_secure_protocol_and_ciphersuite =
       (net::SSLConnectionStatusToVersion(security_info->connection_status) >=
            net::SSL_CONNECTION_VERSION_TLS1_2 &&
        net::IsSecureTLSCipherSuite(net::SSLConnectionStatusToCipherSuite(
            security_info->connection_status)));
 
   security_info->sct_verify_statuses =
       visible_security_state.sct_verify_statuses;
 
-  security_info->security_level =
-      GetSecurityLevelForRequest(visible_security_state, client, cert,
-                                 security_info->sha1_deprecation_status,
-                                 security_info->mixed_content_status);
+  security_info->security_level = GetSecurityLevelForRequest(
+      visible_security_state, client, cert,
+      security_info->sha1_deprecation_status,
+      security_info->mixed_content_status,
+      security_info->content_with_cert_errors_status);
 }
 
 }  // namespace
 
 const SecurityStateModel::SecurityLevel
     SecurityStateModel::kDisplayedInsecureContentLevel =
         SecurityStateModel::NONE;
 const SecurityStateModel::SecurityLevel
     SecurityStateModel::kRanInsecureContentLevel =
         SecurityStateModel::SECURITY_ERROR;
 
 SecurityStateModel::SecurityInfo::SecurityInfo()
     : security_level(SecurityStateModel::NONE),
       sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1),
       mixed_content_status(SecurityStateModel::CONTENT_STATUS_NONE),
+      content_with_cert_errors_status(SecurityStateModel::CONTENT_STATUS_NONE),
       scheme_is_cryptographic(false),
       cert_status(0),
       cert_id(0),
       security_bits(-1),
       connection_status(0),
       is_secure_protocol_and_ciphersuite(false),
       pkp_bypassed(false) {}
 
 SecurityStateModel::SecurityInfo::~SecurityInfo() {}
 
@@ skipping 33 matching lines @@
 
 SecurityStateModel::VisibleSecurityState::VisibleSecurityState()
     : initialized(false),
       initial_security_level(SecurityStateModel::NONE),
       cert_id(0),
       cert_status(0),
       connection_status(0),
       security_bits(-1),
       displayed_mixed_content(false),
       ran_mixed_content(false),
+      displayed_content_with_cert_errors(false),
+      ran_content_with_cert_errors(false),
       pkp_bypassed(false) {}
 
 SecurityStateModel::VisibleSecurityState::~VisibleSecurityState() {}
 
 bool SecurityStateModel::VisibleSecurityState::operator==(
     const SecurityStateModel::VisibleSecurityState& other) const {
   return (url == other.url &&
           initial_security_level == other.initial_security_level &&
           cert_id == other.cert_id && cert_status == other.cert_status &&
           connection_status == other.connection_status &&
           security_bits == other.security_bits &&
           sct_verify_statuses == other.sct_verify_statuses &&
           displayed_mixed_content == other.displayed_mixed_content &&
           ran_mixed_content == other.ran_mixed_content &&
+          displayed_content_with_cert_errors ==
+              other.displayed_content_with_cert_errors &&
+          ran_content_with_cert_errors == other.ran_content_with_cert_errors &&
           pkp_bypassed == other.pkp_bypassed);
 }
 
 }  // namespace security_state