Track subresources with cert errors separately from mixed content

content/browser/ssl/ssl_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ssl/ssl_policy.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
@@ skipping 130 matching lines @@
     return;
 
   SiteInstance* site_instance = entry->site_instance();
   if (!site_instance)
       return;
 
   backend_->HostRanInsecureContent(security_origin.host(),
                                    site_instance->GetProcess()->GetID());
 }
 
+void SSLPolicy::DidRunContentWithCertErrors(NavigationEntryImpl* entry,
+                                            const GURL& security_origin) {
+  if (!entry)
+    return;
+
+  SiteInstance* site_instance = entry->site_instance();
+  if (!site_instance)
+    return;
+
+  backend_->HostRanContentWithCertErrors(security_origin.host(),
+                                         site_instance->GetProcess()->GetID());
+}
+
 void SSLPolicy::OnRequestStarted(const GURL& url,
                                  int cert_id,
                                  net::CertStatus cert_status) {
   if (cert_id && url.SchemeIsCryptographic() &&
       !net::IsCertStatusError(cert_status)) {
     // If the scheme is https: or wss: *and* the security info for the
     // cert has been set (i.e. the cert id is not 0) and the cert did
     // not have any errors, revoke any previous decisions that
     // have occurred. If the cert info has not been set, do nothing since it
     // isn't known if the connection was actually a valid connection or if it
     // had a cert error.
     SSLGoodCertSeenEvent event = NO_PREVIOUS_EXCEPTION;
     if (backend_->HasAllowException(url.host())) {
       // If there's no certificate error, a good certificate has been seen, so
       // clear out any exceptions that were made by the user for bad
       // certificates. This intentionally does not apply to cached resources
       // (see https://crbug.com/634553 for an explanation).
       backend_->RevokeUserAllowExceptions(url.host());
       event = HAD_PREVIOUS_EXCEPTION;
     }
     UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.good_cert_seen", event,
                               SSL_GOOD_CERT_SEEN_EVENT_MAX);
   }
 }
 
 void SSLPolicy::UpdateEntry(NavigationEntryImpl* entry,
                             WebContents* web_contents) {
   DCHECK(entry);
 
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(web_contents);
+
   InitializeEntryIfNeeded(entry);
 
   if (entry->GetSSL().security_style == SECURITY_STYLE_UNAUTHENTICATED)
     return;
 
-  if (!web_contents->DisplayedInsecureContent())
+  if (!web_contents_impl->DisplayedInsecureContent())
     entry->GetSSL().content_status &= ~SSLStatus::DISPLAYED_INSECURE_CONTENT;
 
-  if (web_contents->DisplayedInsecureContent())
+  if (web_contents_impl->DisplayedInsecureContent())
     entry->GetSSL().content_status |= SSLStatus::DISPLAYED_INSECURE_CONTENT;
 
+  if (!web_contents_impl->DisplayedContentWithCertErrors())
+    entry->GetSSL().content_status &=
+        ~SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
+  if (web_contents_impl->DisplayedContentWithCertErrors())
+    entry->GetSSL().content_status |=
+        SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
+
   SiteInstance* site_instance = entry->site_instance();
   // Note that |site_instance| can be NULL here because NavigationEntries don't
   // necessarily have site instances.  Without a process, the entry can't
   // possibly have insecure content.  See bug http://crbug.com/12423.
   if (site_instance &&
       backend_->DidHostRunInsecureContent(
           entry->GetURL().host(), site_instance->GetProcess()->GetID())) {
     entry->GetSSL().security_style =
         SECURITY_STYLE_AUTHENTICATION_BROKEN;
     entry->GetSSL().content_status |= SSLStatus::RAN_INSECURE_CONTENT;
   }
+
+  if (site_instance &&
+      backend_->DidHostRunContentWithCertErrors(
+          entry->GetURL().host(), site_instance->GetProcess()->GetID())) {
+    entry->GetSSL().security_style = SECURITY_STYLE_AUTHENTICATION_BROKEN;
+    entry->GetSSL().content_status |= SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
+  }
 }
 
 // Static
 SecurityStyle SSLPolicy::GetSecurityStyleForResource(
     const GURL& url,
     int cert_id,
     net::CertStatus cert_status) {
   // An HTTPS response may not have a certificate for some reason.  When that
   // happens, use the unauthenticated (HTTP) rather than the authentication
   // broken security style so that we can detect this error condition.
@@ skipping 33 matching lines @@
 
 void SSLPolicy::InitializeEntryIfNeeded(NavigationEntryImpl* entry) {
   if (entry->GetSSL().security_style != SECURITY_STYLE_UNKNOWN)
     return;
 
   entry->GetSSL().security_style = GetSecurityStyleForResource(
       entry->GetURL(), entry->GetSSL().cert_id, entry->GetSSL().cert_status);
 }
 
 }  // namespace content