Add a console messsage for HTTP-bad

chrome/browser/ssl/chrome_security_state_model_client.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include <openssl/ssl.h>
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/policy_cert_service.h"
 #include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
 #include "chrome/grit/generated_resources.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/security_style_explanation.h"
 #include "content/public/browser/security_style_explanations.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/origin_util.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "ui/base/l10n/l10n_util.h"
@@ skipping 118 matching lines @@
       g_browser_process->safe_browsing_service();
   if (!sb_service)
     return;
   scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
   if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents(
           entry->GetURL(), false, entry, web_contents, false)) {
     state->fails_malware_check = true;
   }
 }
 
+// Logs a message to the console if the security level has been
+// downgraded to HTTP_SHOW_WARNING. Returns true if the console message
+// was logged, false otherwise.
+bool MaybeLogHttpWarning(
+    content::WebContents* web_contents,
+    const security_state::SecurityStateModel::SecurityInfo* const
+        security_info) {
+  if (security_info->security_level ==
+      security_state::SecurityStateModel::HTTP_SHOW_WARNING) {
+    web_contents->GetMainFrame()->AddMessageToConsole(
+        content::CONSOLE_MESSAGE_LEVEL_WARNING,
+        base::StringPrintf("In Chrome M56 (Jan 2017), this page will be marked "

[elawrence, 2016/10/12 02:09:45]

I'll betray my lack of understanding of Chrome's use of strings by asking why we
need a printf here when it feels like a normal string constant should work?

Do we have an official document that defines the public name for UI pieces? E.g.
"URL bar" vs. "Omnibox" vs. "Security Chip" etc?

[estark, 2016/10/12 02:43:19]

Err... that would be because I mindlessly based this on a different console
message which also uses base::StringPrintf for apparently no reason. Fixed.
Not sure. I'll cc emilyschechter, got the string from her.

+                           "as \"not secure\" in the URL bar. For more "
+                           "information see https://goo.gl/zmWq3m"));
+    return true;
+  }
+  return false;
+}
+
 }  // namespace
 
 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient(
     content::WebContents* web_contents)
     : web_contents_(web_contents),
-      security_state_model_(new SecurityStateModel()) {
+      security_state_model_(new SecurityStateModel()),
+      logged_http_warning_on_current_navigation_(false) {
   security_state_model_->SetClient(this);
+  WebContentsObserver::Observe(web_contents_);
 }
 
 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {}
 
 // static
 blink::WebSecurityStyle ChromeSecurityStateModelClient::GetSecurityStyle(
     const security_state::SecurityStateModel::SecurityInfo& security_info,
     content::SecurityStyleExplanations* security_style_explanations) {
   const blink::WebSecurityStyle security_style =
       SecurityLevelToSecurityStyle(security_info.security_level);
@@ skipping 110 matching lines @@
             "Public-Key Pinning Bypassed",
             "Public-key pinning was bypassed by a local root certificate."));
   }
 
   return security_style;
 }
 
 void ChromeSecurityStateModelClient::GetSecurityInfo(
     SecurityStateModel::SecurityInfo* result) const {
   security_state_model_->GetSecurityInfo(result);
+  if (!logged_http_warning_on_current_navigation_) {
+    logged_http_warning_on_current_navigation_ =
+        MaybeLogHttpWarning(web_contents_, result);
+  }
 }
 
 bool ChromeSecurityStateModelClient::UsedPolicyInstalledCertificate() {
 #if defined(OS_CHROMEOS)
   policy::PolicyCertService* service =
       policy::PolicyCertServiceFactory::GetForProfile(
           Profile::FromBrowserContext(web_contents_->GetBrowserContext()));
   if (service && service->UsedPolicyCertificates())
     return true;
 #endif
   return false;
 }
 
 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) {
   return content::IsOriginSecure(url);
 }
 
+void ChromeSecurityStateModelClient::DidFinishNavigation(
+    content::NavigationHandle* navigation_handle) {
+  logged_http_warning_on_current_navigation_ = false;
+}
+
 void ChromeSecurityStateModelClient::GetVisibleSecurityState(
     SecurityStateModel::VisibleSecurityState* state) {
   content::NavigationEntry* entry =
       web_contents_->GetController().GetVisibleEntry();
   if (!entry) {
     *state = SecurityStateModel::VisibleSecurityState();
     return;
   }
 
   if (!entry->GetSSL().initialized) {
@@ skipping 28 matching lines @@
       !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS);
   state->displayed_password_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
   state->displayed_credit_card_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP);
 
   CheckSafeBrowsingStatus(entry, web_contents_, state);
 }