Teach SecurityStateModel about subresources with cert errors

chrome/browser/ssl/chrome_security_state_model_client_browser_tests.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/strings/string_split.h"
@@ skipping 420 matching lines @@
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
       SecurityStateModel::SECURITY_ERROR,
       SecurityStateModel::NO_DEPRECATED_SHA1,
       SecurityStateModel::CONTENT_STATUS_RAN, false,
       false /* expect cert status error */);
 }
 
+IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+                       ActiveContentWithCertErrors) {
+  ASSERT_TRUE(https_server_.Start());
+  SetUpMockCertVerifierForHttpsServer(0, net::OK);
+
+  // Navigate to an HTTPS page and simulate active content with
+  // certificate errors.
+  ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(web_contents);
+  content::NavigationEntry* entry =
+      web_contents->GetController().GetVisibleEntry();
+  ASSERT_TRUE(entry);
+  entry->GetSSL().content_status |=
+      content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
+
+  ChromeSecurityStateModelClient* model_client =
+      ChromeSecurityStateModelClient::FromWebContents(web_contents);
+  ASSERT_TRUE(model_client);
+  const SecurityStateModel::SecurityInfo& security_info =
+      model_client->GetSecurityInfo();
+
+  EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
+  EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info.security_level);
+  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_RAN,
+            security_info.content_with_cert_errors_status);
+}
+
+IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+                       PassiveContentWithCertErrors) {
+  ASSERT_TRUE(https_server_.Start());
+  SetUpMockCertVerifierForHttpsServer(0, net::OK);
+
+  // Navigate to an HTTPS page and simulate passive content with
+  // certificate errors.
+  ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(web_contents);
+  content::NavigationEntry* entry =
+      web_contents->GetController().GetVisibleEntry();
+  ASSERT_TRUE(entry);
+  entry->GetSSL().content_status |=
+      content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
+  ChromeSecurityStateModelClient* model_client =
+      ChromeSecurityStateModelClient::FromWebContents(web_contents);
+  ASSERT_TRUE(model_client);
+  const SecurityStateModel::SecurityInfo& security_info =
+      model_client->GetSecurityInfo();
+
+  EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
+  EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level);
+  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_DISPLAYED,
+            security_info.content_with_cert_errors_status);
+}
+
+IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+                       ActiveAndPassiveContentWithCertErrors) {
+  ASSERT_TRUE(https_server_.Start());
+  SetUpMockCertVerifierForHttpsServer(0, net::OK);
+
+  // Navigate to an HTTPS page and simulate active and passive content
+  // with certificate errors.
+  ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(web_contents);
+  content::NavigationEntry* entry =
+      web_contents->GetController().GetVisibleEntry();
+  ASSERT_TRUE(entry);
+  entry->GetSSL().content_status |=
+      content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
+  entry->GetSSL().content_status |=
+      content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
+  ChromeSecurityStateModelClient* model_client =
+      ChromeSecurityStateModelClient::FromWebContents(web_contents);
+  ASSERT_TRUE(model_client);
+  const SecurityStateModel::SecurityInfo& security_info =
+      model_client->GetSecurityInfo();
+
+  EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
+  EXPECT_EQ(SecurityStateModel::SECURITY_ERROR, security_info.security_level);
+  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN,
+            security_info.content_with_cert_errors_status);
+}
+
 // Same as the test above but with a long-lived SHA1 cert.
 IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
                        MixedContentWithBrokenSHA1) {
   ASSERT_TRUE(embedded_test_server()->Start());
   ASSERT_TRUE(https_server_.Start());
   // The test server uses a long-lived cert by default, so a SHA1
   // signature in it will register as a "broken" condition rather than
   // "warning".
   SetUpMockCertVerifierForHttpsServer(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT,
                                       net::OK);
@@ skipping 798 matching lines @@
   ChromeSecurityStateModelClient* model_client =
       ChromeSecurityStateModelClient::FromWebContents(web_contents);
   ASSERT_TRUE(model_client);
   const SecurityStateModel::SecurityInfo& security_info =
       model_client->GetSecurityInfo();
   EXPECT_EQ(SecurityStateModel::SECURE, security_info.security_level);
   EXPECT_EQ(kTestSCTStatuses, security_info.sct_verify_statuses);
 }
 
 }  // namespace