Send certificates to devtools when it's open instead of using certId

content/browser/devtools/render_frame_devtools_agent_host.cc

Index: content/browser/devtools/render_frame_devtools_agent_host.cc
diff --git a/content/browser/devtools/render_frame_devtools_agent_host.cc b/content/browser/devtools/render_frame_devtools_agent_host.cc
index fd05028a561ca3ce7da2207ec4ddaaff173f290e..09a343f7187bbd9727a94fc03fee02b461417681 100644
--- a/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/content/browser/devtools/render_frame_devtools_agent_host.cc
@@ -39,10 +39,12 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/cert_store.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/browser_side_navigation_policy.h"
+#include "net/cert/x509_certificate.h"
 
 #if defined(OS_ANDROID)
 #include "content/public/browser/render_widget_host_view.h"
@@ -743,6 +745,8 @@ bool RenderFrameDevToolsAgentHost::OnMessageReceived(
                         OnDispatchOnInspectorFrontend)
     IPC_MESSAGE_HANDLER(DevToolsAgentHostMsg_RequestNewWindow,
                         OnRequestNewWindow)
+    IPC_MESSAGE_HANDLER(DevToolsAgentHostMsg_ShowCertificateViewer,
+                        OnShowCertificateViewer)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -1013,6 +1017,24 @@ void RenderFrameDevToolsAgentHost::OnRequestNewWindow(
       sender->GetRoutingID(), success));
 }
 
+void RenderFrameDevToolsAgentHost::OnShowCertificateViewer(
+    RenderFrameHost* sender, const std::string& certificate) {
+  base::Pickle pickle(certificate.data(), certificate.size());
+  base::PickleIterator iterator(pickle);
+  scoped_refptr<net::X509Certificate> cert =
+      net::X509Certificate::CreateFromPickle(
+          &iterator,
+          net::X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V3);
+  DCHECK(cert);

[estark, 2016/09/01 00:20:03]

Instead of DCHECK, should this kill the renderer if CreateFromPickle() is false?
A compromised renderer could send a cert that fails to deserialize.

[jam, 2016/09/01 01:14:02]

That would be a null pointer dereference, which afaik is ok (i.e. we don't try
to protect against a bad renderer killing the browser since there are too many
ways to do that).

+  // TODO(jam): temporarily add the certificate to the cert store (it will
+  // already be there, so this just gets an ID) so that we don't have to change
+  // the WCD method signature (will be done in followups).
+  int cert_id = CertStore::GetInstance()->StoreCert(
+      cert.get(), sender->GetProcess()->GetID());
+  web_contents()->GetDelegate()->ShowCertificateViewerInDevTools(
+      web_contents(), cert_id);
+}
+
 bool RenderFrameDevToolsAgentHost::HasRenderFrameHost(
     RenderFrameHost* host) {
   return (current_ && current_->host() == host) ||