Send certificates to devtools when it's open instead of using certId

content/browser/devtools/render_frame_devtools_agent_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 
 #include <tuple>
 #include <utility>
 
 #include "base/guid.h"
@@ skipping 21 matching lines @@
 #include "content/browser/devtools/protocol/tracing_handler.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/input/input_router_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/cert_store.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/browser_side_navigation_policy.h"
+#include "net/cert/x509_certificate.h"
 
 #if defined(OS_ANDROID)
 #include "content/public/browser/render_widget_host_view.h"
 #include "device/power_save_blocker/power_save_blocker.h"
 #endif
 
 namespace content {
 
 typedef std::vector<RenderFrameDevToolsAgentHost*> Instances;
 
@@ skipping 680 matching lines @@
     return false;
   if (!IsAttached())
     return false;
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(RenderFrameDevToolsAgentHost, message,
                                    render_frame_host)
     IPC_MESSAGE_HANDLER(DevToolsClientMsg_DispatchOnInspectorFrontend,
                         OnDispatchOnInspectorFrontend)
     IPC_MESSAGE_HANDLER(DevToolsAgentHostMsg_RequestNewWindow,
                         OnRequestNewWindow)
+    IPC_MESSAGE_HANDLER(DevToolsAgentHostMsg_ShowCertificateViewer,
+                        OnShowCertificateViewer)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void RenderFrameDevToolsAgentHost::DidAttachInterstitialPage() {
   if (page_handler_)
     page_handler_->DidAttachInterstitialPage();
 
   // TODO(dgozman): this may break for cross-process subframes.
@@ skipping 250 matching lines @@
   if (IsAttached() && sender->GetRoutingID() != new_routing_id && frame_host) {
     scoped_refptr<DevToolsAgentHost> agent =
         DevToolsAgentHost::GetOrCreateFor(frame_host);
     success = agent->Inspect();
   }
 
   sender->Send(new DevToolsAgentMsg_RequestNewWindow_ACK(
       sender->GetRoutingID(), success));
 }
 
+void RenderFrameDevToolsAgentHost::OnShowCertificateViewer(
+    RenderFrameHost* sender, const std::string& certificate) {
+  base::Pickle pickle(certificate.data(), certificate.size());
+  base::PickleIterator iterator(pickle);
+  scoped_refptr<net::X509Certificate> cert =
+      net::X509Certificate::CreateFromPickle(
+          &iterator,
+          net::X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V3);
+  DCHECK(cert);

[estark, 2016/09/01 00:20:03]

Instead of DCHECK, should this kill the renderer if CreateFromPickle() is false?
A compromised renderer could send a cert that fails to deserialize.

[jam, 2016/09/01 01:14:02]

That would be a null pointer dereference, which afaik is ok (i.e. we don't try
to protect against a bad renderer killing the browser since there are too many
ways to do that).

+  // TODO(jam): temporarily add the certificate to the cert store (it will
+  // already be there, so this just gets an ID) so that we don't have to change
+  // the WCD method signature (will be done in followups).
+  int cert_id = CertStore::GetInstance()->StoreCert(
+      cert.get(), sender->GetProcess()->GetID());
+  web_contents()->GetDelegate()->ShowCertificateViewerInDevTools(
+      web_contents(), cert_id);
+}
+
 bool RenderFrameDevToolsAgentHost::HasRenderFrameHost(
     RenderFrameHost* host) {
   return (current_ && current_->host() == host) ||
       (pending_ && pending_->host() == host);
 }
 
 bool RenderFrameDevToolsAgentHost::IsChildFrame() {
   return current_ && current_->host()->GetParent();
 }
 
 }  // namespace content