Add a console messsage for HTTP-bad

chrome/browser/ssl/chrome_security_state_model_client.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include <openssl/ssl.h>
 
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/policy_cert_service.h"
 #include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
 #include "chrome/grit/generated_resources.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/security_style_explanation.h"
 #include "content/public/browser/security_style_explanations.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/origin_util.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "ui/base/l10n/l10n_util.h"
@@ skipping 118 matching lines @@
       g_browser_process->safe_browsing_service();
   if (!sb_service)
     return;
   scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
   if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents(
           entry->GetURL(), false, entry, web_contents, false)) {
     state->fails_malware_check = true;
   }
 }
 
+// Logs a message to the console if the security level has been
+// downgraded to HTTP_SHOW_WARNING. Returns true if the console message
+// was logged, false otherwise.
+bool MaybeLogHttpWarning(
+    content::WebContents* web_contents,
+    const security_state::SecurityStateModel::SecurityInfo* const
+        security_info) {
+  if (security_info->security_level ==
+      security_state::SecurityStateModel::HTTP_SHOW_WARNING) {
+    web_contents->GetMainFrame()->AddMessageToConsole(
+        content::CONSOLE_MESSAGE_LEVEL_WARNING,
+        "In Chrome M56 (Jan 2017), this page will be marked "
+        "as \"not secure\" in the URL bar. For more "
+        "information see https://goo.gl/zmWq3m");
+    return true;
+  }
+  return false;
+}
+
 }  // namespace
 
 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient(
     content::WebContents* web_contents)
     : web_contents_(web_contents),
-      security_state_model_(new SecurityStateModel()) {
+      security_state_model_(new SecurityStateModel()),
+      logged_http_warning_on_current_navigation_(false) {
   security_state_model_->SetClient(this);
+  WebContentsObserver::Observe(web_contents_);
 }
 
 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {}
 
 // static
 blink::WebSecurityStyle ChromeSecurityStateModelClient::GetSecurityStyle(
     const security_state::SecurityStateModel::SecurityInfo& security_info,
     content::SecurityStyleExplanations* security_style_explanations) {
   const blink::WebSecurityStyle security_style =
       SecurityLevelToSecurityStyle(security_info.security_level);
@@ skipping 110 matching lines @@
             "Public-Key Pinning Bypassed",
             "Public-key pinning was bypassed by a local root certificate."));
   }
 
   return security_style;
 }
 
 void ChromeSecurityStateModelClient::GetSecurityInfo(
     SecurityStateModel::SecurityInfo* result) const {
   security_state_model_->GetSecurityInfo(result);
+  if (!logged_http_warning_on_current_navigation_) {
+    logged_http_warning_on_current_navigation_ =
+        MaybeLogHttpWarning(web_contents_, result);
+  }

[meacer, 2016/10/13 17:41:01]

I'm sure there is a good reason, but it feels a bit funny to log the message
from a getter. Is the idea that we might need to add the message any time page
state changes? Can we not observe security state changes instead?

[estark, 2016/10/13 17:59:17]

Yeah, I agree it's kinda gross, see my first comment in the CL thread (that was
before I had added you to the review).

Looking at it with fresh eyes, though, I think maybe it would be better to do
this from within Browser::VisibleSSLStateChanged(). I'll poke around a little
bit to make sure that it does what I expect.

 }
 
 bool ChromeSecurityStateModelClient::UsedPolicyInstalledCertificate() {
 #if defined(OS_CHROMEOS)
   policy::PolicyCertService* service =
       policy::PolicyCertServiceFactory::GetForProfile(
           Profile::FromBrowserContext(web_contents_->GetBrowserContext()));
   if (service && service->UsedPolicyCertificates())
     return true;
 #endif
   return false;
 }
 
 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) {
   return content::IsOriginSecure(url);
 }
 
+void ChromeSecurityStateModelClient::DidFinishNavigation(
+    content::NavigationHandle* navigation_handle) {
+  if (navigation_handle->IsInMainFrame()) {
+    logged_http_warning_on_current_navigation_ = false;
+  }

[meacer, 2016/10/13 17:41:01]

Should we clear this bit when there is a new navigation, instead of the current
one finishing? Or is the assumption that we'll never log the message while the
navigation is happening, so both events are equal from our perspective?

[estark, 2016/10/13 17:59:17]

(will revisit this comment once I settle the question of whether we can instead
do this within Browser::VisibleSSLStateChanged)

[estark, 2016/10/14 17:57:06]

I think it's more correct to clear the flag when the navigation finishes. If the
navigation stops, for example, and the pending entry is thrown out, then we
don't want to have reset the flag. Does that make sense?

+}
+
 void ChromeSecurityStateModelClient::GetVisibleSecurityState(
     SecurityStateModel::VisibleSecurityState* state) {
   content::NavigationEntry* entry =
       web_contents_->GetController().GetVisibleEntry();
   if (!entry) {
     *state = SecurityStateModel::VisibleSecurityState();
     return;
   }
 
   if (!entry->GetSSL().initialized) {
@@ skipping 28 matching lines @@
       !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS);
   state->displayed_password_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
   state->displayed_credit_card_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP);
 
   CheckSafeBrowsingStatus(entry, web_contents_, state);
 }