Downgrade security state while displaying an SB interstitial

chrome/browser/ssl/chrome_security_state_model_client.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
@@ skipping 136 matching lines @@
   description_replacements.push_back(cipher_name);
 
   security_style_explanations->info_explanations.push_back(
       content::SecurityStyleExplanation(
           l10n_util::GetStringUTF8(IDS_OBSOLETE_SSL_SUMMARY),
           base::UTF16ToUTF8(
               l10n_util::GetStringFUTF16(IDS_OBSOLETE_SSL_DESCRIPTION,
                                          description_replacements, nullptr))));
 }
 
+// Check to see whether the security state should be downgraded to reflect
+// a Safe Browsing verdict.
+void CheckSafeBrowsingStatus(content::NavigationEntry* entry,
+                             content::WebContents* web_contents,
+                             SecurityStateModel::VisibleSecurityState* state) {
+  safe_browsing::SafeBrowsingService* sb_service =
+      g_browser_process->safe_browsing_service();
+  if (!sb_service)
+    return;
+  scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
+  if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents(
+          entry->GetURL(), false, entry, web_contents, false)) {
+    state->fails_malware_check = true;
+    state->initial_security_level = SecurityStateModel::SECURITY_ERROR;
+  }
+}
+
 }  // namespace
 
 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient(
     content::WebContents* web_contents)
     : web_contents_(web_contents),
       security_state_model_(new SecurityStateModel()) {
   security_state_model_->SetClient(this);
 }
 
 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {}
@@ skipping 122 matching lines @@
 }
 
 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) {
   return content::IsOriginSecure(url);
 }
 
 void ChromeSecurityStateModelClient::GetVisibleSecurityState(
     SecurityStateModel::VisibleSecurityState* state) {
   content::NavigationEntry* entry =
       web_contents_->GetController().GetVisibleEntry();
-  if (!entry ||
-      entry->GetSSL().security_style == content::SECURITY_STYLE_UNKNOWN) {
+  if (!entry) {
     *state = SecurityStateModel::VisibleSecurityState();
     return;
   }
 
+  if (entry->GetSSL().security_style == content::SECURITY_STYLE_UNKNOWN) {
+    *state = SecurityStateModel::VisibleSecurityState();
+    // Connection security information is still being initialized, but malware
+    // status might already be known.
+    CheckSafeBrowsingStatus(entry, web_contents_, state);
+    return;
+  }
+
   state->connection_info_initialized = true;
   state->url = entry->GetURL();
   const content::SSLStatus& ssl = entry->GetSSL();
   state->initial_security_level =
       GetSecurityLevelForSecurityStyle(ssl.security_style);
   state->cert_id = ssl.cert_id;
   state->cert_status = ssl.cert_status;
   state->connection_status = ssl.connection_status;
   state->security_bits = ssl.security_bits;
   state->pkp_bypassed = ssl.pkp_bypassed;
   state->sct_verify_statuses.clear();
   state->sct_verify_statuses.insert(state->sct_verify_statuses.begin(),
                                     ssl.sct_statuses.begin(),
                                     ssl.sct_statuses.end());
   state->displayed_mixed_content =
       !!(ssl.content_status & content::SSLStatus::DISPLAYED_INSECURE_CONTENT);
   state->ran_mixed_content =
       !!(ssl.content_status & content::SSLStatus::RAN_INSECURE_CONTENT);
   state->displayed_content_with_cert_errors =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS);
   state->ran_content_with_cert_errors =
       !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS);
 
-  // Check to see whether the security state should be downgraded to reflect
-  // a Safe Browsing verdict.
-  safe_browsing::SafeBrowsingService* sb_service =
-      g_browser_process->safe_browsing_service();
-  if (!sb_service)
-    return;
-  scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
-  if (sb_ui_manager->IsUrlWhitelistedForWebContents(entry->GetURL(), false,
-                                                    entry, web_contents_)) {
-    state->fails_malware_check = true;
-    state->initial_security_level = SecurityStateModel::SECURITY_ERROR;
-  }
+  CheckSafeBrowsingStatus(entry, web_contents_, state);
 }