Refactor SecurityStateModel/Clients for simplicity and reusability.

chrome/browser/ssl/security_state_tab_helper.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ssl/security_state_tab_helper.h"
+
+#include "base/bind.h"
+#include "base/metrics/histogram_macros.h"
+#include "build/build_config.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/browser/safe_browsing/ui_manager.h"
+#include "components/security_state/content/content_utils.h"
+#include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/origin_util.h"
+#include "net/base/net_errors.h"
+#include "net/cert/x509_certificate.h"
+#include "net/ssl/ssl_cipher_suite_names.h"
+#include "net/ssl/ssl_connection_status_flags.h"
+#include "third_party/boringssl/src/include/openssl/ssl.h"
+#include "ui/base/l10n/l10n_util.h"
+
+DEFINE_WEB_CONTENTS_USER_DATA_KEY(SecurityStateTabHelper);
+
+using safe_browsing::SafeBrowsingUIManager;
+using security_state::SecurityStateModel;
+
+SecurityStateTabHelper::SecurityStateTabHelper(
+    content::WebContents* web_contents)
+    : content::WebContentsObserver(web_contents),
+      model_(new security_state::SecurityStateModel()),
+      logged_http_warning_on_current_navigation_(false) {}
+
+SecurityStateTabHelper::~SecurityStateTabHelper() {}
+
+void SecurityStateTabHelper::GetSecurityInfo(
+    SecurityStateModel::SecurityInfo* result) const {
+  model_->GetSecurityInfo(result, GetVisibleSecurityState(),
+                          UsedPolicyInstalledCertificate(),
+                          base::Bind(&content::IsOriginSecure));
+}
+
+void SecurityStateTabHelper::VisibleSecurityStateChanged() {
+  if (logged_http_warning_on_current_navigation_)
+    return;
+
+  security_state::SecurityStateModel::SecurityInfo security_info;
+  GetSecurityInfo(&security_info);
+  if (!security_info.displayed_private_user_data_input_on_http)
+    return;
+
+  std::string warning;
+  bool warning_is_user_visible = false;
+  switch (security_info.security_level) {
+    case security_state::SecurityStateModel::HTTP_SHOW_WARNING:
+      warning =
+          "This page includes a password or credit card input in a non-secure "
+          "context. A warning has been added to the URL bar. For more "
+          "information, see https://goo.gl/zmWq3m.";
+      warning_is_user_visible = true;
+      break;
+    case security_state::SecurityStateModel::NONE:
+    case security_state::SecurityStateModel::DANGEROUS:
+      warning =
+          "This page includes a password or credit card input in a non-secure "
+          "context. A warning will be added to the URL bar in Chrome 56 (Jan "
+          "2017). For more information, see https://goo.gl/zmWq3m.";
+      break;
+    default:
+      return;
+  }
+
+  logged_http_warning_on_current_navigation_ = true;
+  web_contents()->GetMainFrame()->AddMessageToConsole(
+      content::CONSOLE_MESSAGE_LEVEL_WARNING, warning);
+  UMA_HISTOGRAM_BOOLEAN("Security.HTTPBad.UserWarnedAboutSensitiveInput",
+                        warning_is_user_visible);
+}
+
+void SecurityStateTabHelper::DidFinishNavigation(
+    content::NavigationHandle* navigation_handle) {
+  if (navigation_handle->IsInMainFrame() && !navigation_handle->IsSamePage()) {
+    // Only reset the console message flag for main-frame navigations,
+    // and not for same-page navigations like reference fragments and pushState.
+    logged_http_warning_on_current_navigation_ = false;
+  }
+}
+
+bool SecurityStateTabHelper::UsedPolicyInstalledCertificate() const {
+#if defined(OS_CHROMEOS)
+  policy::PolicyCertService* service =
+      policy::PolicyCertServiceFactory::GetForProfile(
+          Profile::FromBrowserContext(web_contents()->GetBrowserContext()));
+  if (service && service->UsedPolicyCertificates())
+    return true;
+#endif
+  return false;
+}
+
+bool SecurityStateTabHelper::GetMalwareStatus() const {
+  content::NavigationEntry* entry =
+      web_contents()->GetController().GetVisibleEntry();
+  if (!entry)
+    return false;
+  safe_browsing::SafeBrowsingService* sb_service =
+      g_browser_process->safe_browsing_service();
+  if (!sb_service)
+    return false;
+  scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager();
+  if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents(
+          entry->GetURL(), false, entry, web_contents(), false)) {
+    return true;
+  }
+  return false;
+}
+
+std::unique_ptr<security_state::SecurityStateModel::VisibleSecurityState>
+SecurityStateTabHelper::GetVisibleSecurityState() const {
+  auto state =
+      security_state_content_utils::GetVisibleSecurityState(web_contents());
+
+  // Malware status might already be known even if connection security
+  // information is still being initialized, thus no need to check for that.
+  state->fails_malware_check = GetMalwareStatus();
+
+  return state;
+}