Downgrade security state while displaying an SB interstitial

chrome/browser/ssl/chrome_security_state_model_client.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 63 matching lines @@
     case SecurityStateModel::SECURE:
       return content::SECURITY_STYLE_AUTHENTICATED;
     case SecurityStateModel::SECURITY_ERROR:
       return content::SECURITY_STYLE_AUTHENTICATION_BROKEN;
   }
 
   NOTREACHED();
   return content::SECURITY_STYLE_UNKNOWN;
 }
 
+// Check to see whether the security state should be downgraded to reflect
+// a Safe Browsing verdict.
+void CheckSafeBrowsingStatus(content::NavigationEntry* entry,
+                             content::WebContents* web_contents,
+                             SecurityStateModel::VisibleSecurityState* state) {
+  safe_browsing::SafeBrowsingService* sb_service =
+      g_browser_process->safe_browsing_service();
+  if (!sb_service)
+    return;
+  scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
+  if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents(
+          entry->GetURL(), false, entry, web_contents, false)) {
+    state->fails_malware_check = true;
+    state->initial_security_level = SecurityStateModel::SECURITY_ERROR;
+  }
+}
+
 }  // namespace
 
 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient(
     content::WebContents* web_contents)
     : web_contents_(web_contents),
       security_state_model_(new SecurityStateModel()) {
   security_state_model_->SetClient(this);
 }
 
 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {}
@@ skipping 128 matching lines @@
 }
 
 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) {
   return content::IsOriginSecure(url);
 }
 
 void ChromeSecurityStateModelClient::GetVisibleSecurityState(
     SecurityStateModel::VisibleSecurityState* state) {
   content::NavigationEntry* entry =
       web_contents_->GetController().GetVisibleEntry();
-  if (!entry ||
-      entry->GetSSL().security_style == content::SECURITY_STYLE_UNKNOWN) {
+  if (!entry) {
     *state = SecurityStateModel::VisibleSecurityState();
     return;
   }
 
+  if (entry->GetSSL().security_style == content::SECURITY_STYLE_UNKNOWN) {

[estark, 2016/08/25 06:54:06]

nit: could you add a comment around here along the lines of "Connection security
information is still being initialized, but malware status might already be
known"?

[felt, 2016/08/25 15:17:27]

Done.

+    *state = SecurityStateModel::VisibleSecurityState();
+    CheckSafeBrowsingStatus(entry, web_contents_, state);
+    return;
+  }
+
   state->connection_info_initialized = true;
   state->url = entry->GetURL();
   const content::SSLStatus& ssl = entry->GetSSL();
   state->initial_security_level =
       GetSecurityLevelForSecurityStyle(ssl.security_style);
   state->cert_id = ssl.cert_id;
   state->cert_status = ssl.cert_status;
   state->connection_status = ssl.connection_status;
   state->security_bits = ssl.security_bits;
   state->pkp_bypassed = ssl.pkp_bypassed;
   state->sct_verify_statuses.clear();
   state->sct_verify_statuses.insert(state->sct_verify_statuses.begin(),
                                     ssl.sct_statuses.begin(),
                                     ssl.sct_statuses.end());
   state->displayed_mixed_content =
       !!(ssl.content_status & content::SSLStatus::DISPLAYED_INSECURE_CONTENT);
   state->ran_mixed_content =
       !!(ssl.content_status & content::SSLStatus::RAN_INSECURE_CONTENT);
   state->displayed_content_with_cert_errors =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS);
   state->ran_content_with_cert_errors =
       !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS);
 
-  // Check to see whether the security state should be downgraded to reflect
-  // a Safe Browsing verdict.
-  safe_browsing::SafeBrowsingService* sb_service =
-      g_browser_process->safe_browsing_service();
-  if (!sb_service)
-    return;
-  scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
-  if (sb_ui_manager->IsUrlWhitelistedForWebContents(entry->GetURL(), false,
-                                                    entry, web_contents_)) {
-    state->fails_malware_check = true;
-    state->initial_security_level = SecurityStateModel::SECURITY_ERROR;
-  }
+  CheckSafeBrowsingStatus(entry, web_contents_, state);
 }