Expose malware/phishing/etc. distinction from SafeBrowsingUIManager

components/security_state/security_state_model.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/security_state_model.h"
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
@@ skipping 107 matching lines @@
   return SecurityStateModel::CONTENT_STATUS_NONE;
 }
 
 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest(
     const SecurityStateModel::VisibleSecurityState& visible_security_state,
     SecurityStateModelClient* client,
     SecurityStateModel::SHA1DeprecationStatus sha1_status,
     SecurityStateModel::ContentStatus mixed_content_status,
     SecurityStateModel::ContentStatus content_with_cert_errors_status) {
   DCHECK(visible_security_state.connection_info_initialized ||
-         visible_security_state.fails_malware_check);
+         visible_security_state.malicious_content_status !=
+             SecurityStateModel::MALICIOUS_CONTENT_STATUS_NONE);
 
   // Override the connection security information if the website failed the
   // browser's malware checks.
-  if (visible_security_state.fails_malware_check)
+  if (visible_security_state.malicious_content_status !=
+      SecurityStateModel::MALICIOUS_CONTENT_STATUS_NONE) {
     return SecurityStateModel::DANGEROUS;
+  }
 
   GURL url = visible_security_state.url;
 
   bool is_cryptographic_with_certificate =
       (url.SchemeIsCryptographic() && visible_security_state.certificate);
 
   // Set the security level to DANGEROUS for major certificate errors.
   if (is_cryptographic_with_certificate &&
       net::IsCertStatusError(visible_security_state.cert_status) &&
       !net::IsCertStatusMinorError(visible_security_state.cert_status)) {
@@ skipping 57 matching lines @@
   }
   return SecurityStateModel::SECURE;
 }
 
 void SecurityInfoForRequest(
     SecurityStateModelClient* client,
     const SecurityStateModel::VisibleSecurityState& visible_security_state,
     SecurityStateModel::SecurityInfo* security_info) {
   if (!visible_security_state.connection_info_initialized) {
     *security_info = SecurityStateModel::SecurityInfo();
-    security_info->fails_malware_check =
-        visible_security_state.fails_malware_check;
-    if (security_info->fails_malware_check) {
+    security_info->malicious_content_status =
+        visible_security_state.malicious_content_status;
+    if (security_info->malicious_content_status !=
+        SecurityStateModel::MALICIOUS_CONTENT_STATUS_NONE) {

[Nathan Parker, 2016/11/10 00:13:03]

I don't understand what this logic does, but I trust you do. It appears to
mirror the old code.

[estark, 2016/11/11 20:28:14]

Yeah the whole |connection_info_initialized| thing is kinda weird and probably
unnecessary (a byproduct of https://crbug.com/655220, I think). IIRC this is
basically handling the case where if the navigation hasn't committed yet, we
won't have connection security info yet, but we still want to reflect the
Dangerous status in the omnibox if the URL is marked bad because of SB.

       security_info->security_level = GetSecurityLevelForRequest(
           visible_security_state, client, SecurityStateModel::UNKNOWN_SHA1,
           SecurityStateModel::CONTENT_STATUS_UNKNOWN,
           SecurityStateModel::CONTENT_STATUS_UNKNOWN);
     }
     return;
   }
   security_info->certificate = visible_security_state.certificate;
   security_info->sha1_deprecation_status =
       GetSHA1DeprecationStatus(visible_security_state);
   security_info->mixed_content_status =
       GetContentStatus(visible_security_state.displayed_mixed_content,
                        visible_security_state.ran_mixed_content);
   security_info->content_with_cert_errors_status = GetContentStatus(
       visible_security_state.displayed_content_with_cert_errors,
       visible_security_state.ran_content_with_cert_errors);
   security_info->security_bits = visible_security_state.security_bits;
   security_info->connection_status = visible_security_state.connection_status;
   security_info->key_exchange_group = visible_security_state.key_exchange_group;
   security_info->cert_status = visible_security_state.cert_status;
   security_info->scheme_is_cryptographic =
       visible_security_state.url.SchemeIsCryptographic();
   security_info->obsolete_ssl_status =
       net::ObsoleteSSLStatus(security_info->connection_status);
   security_info->pkp_bypassed = visible_security_state.pkp_bypassed;
   security_info->sct_verify_statuses =
       visible_security_state.sct_verify_statuses;
 
-  security_info->fails_malware_check =
-      visible_security_state.fails_malware_check;
+  security_info->malicious_content_status =
+      visible_security_state.malicious_content_status;
 
   security_info->displayed_private_user_data_input_on_http =
       visible_security_state.displayed_password_field_on_http ||
       visible_security_state.displayed_credit_card_field_on_http;
 
   security_info->security_level = GetSecurityLevelForRequest(
       visible_security_state, client, security_info->sha1_deprecation_status,
       security_info->mixed_content_status,
       security_info->content_with_cert_errors_status);
 }
 
 }  // namespace
 
 const SecurityStateModel::SecurityLevel
     SecurityStateModel::kDisplayedInsecureContentLevel =
         SecurityStateModel::NONE;
 const SecurityStateModel::SecurityLevel
     SecurityStateModel::kRanInsecureContentLevel =
         SecurityStateModel::DANGEROUS;
 
 SecurityStateModel::SecurityInfo::SecurityInfo()
     : security_level(SecurityStateModel::NONE),
-      fails_malware_check(false),
+      malicious_content_status(
+          SecurityStateModel::MALICIOUS_CONTENT_STATUS_NONE),
       sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1),
       mixed_content_status(SecurityStateModel::CONTENT_STATUS_NONE),
       content_with_cert_errors_status(SecurityStateModel::CONTENT_STATUS_NONE),
       scheme_is_cryptographic(false),
       cert_status(0),
       security_bits(-1),
       connection_status(0),
       key_exchange_group(0),
       obsolete_ssl_status(net::OBSOLETE_SSL_NONE),
       pkp_bypassed(false),
@@ skipping 10 matching lines @@
   VisibleSecurityState new_visible_state;
   client_->GetVisibleSecurityState(&new_visible_state);
   SecurityInfoForRequest(client_, new_visible_state, result);
 }
 
 void SecurityStateModel::SetClient(SecurityStateModelClient* client) {
   client_ = client;
 }
 
 SecurityStateModel::VisibleSecurityState::VisibleSecurityState()
-    : fails_malware_check(false),
+    : malicious_content_status(
+          SecurityStateModel::MALICIOUS_CONTENT_STATUS_NONE),
       connection_info_initialized(false),
       cert_status(0),
       connection_status(0),
       key_exchange_group(0),
       security_bits(-1),
       displayed_mixed_content(false),
       ran_mixed_content(false),
       displayed_content_with_cert_errors(false),
       ran_content_with_cert_errors(false),
       pkp_bypassed(false),
       displayed_password_field_on_http(false),
       displayed_credit_card_field_on_http(false) {}
 
 SecurityStateModel::VisibleSecurityState::~VisibleSecurityState() {}
 
 bool SecurityStateModel::VisibleSecurityState::operator==(
     const SecurityStateModel::VisibleSecurityState& other) const {
   return (url == other.url &&
-          fails_malware_check == other.fails_malware_check &&
+          malicious_content_status == other.malicious_content_status &&
           !!certificate == !!other.certificate &&

[Nathan Parker, 2016/11/10 00:13:03]

ooo I like all the the !!'s.  That mirrors my mood today.

           (certificate ? certificate->Equals(other.certificate.get()) : true) &&
           connection_status == other.connection_status &&
           key_exchange_group == other.key_exchange_group &&
           security_bits == other.security_bits &&
           sct_verify_statuses == other.sct_verify_statuses &&
           displayed_mixed_content == other.displayed_mixed_content &&
           ran_mixed_content == other.ran_mixed_content &&
           displayed_content_with_cert_errors ==
               other.displayed_content_with_cert_errors &&
           ran_content_with_cert_errors == other.ran_content_with_cert_errors &&
           pkp_bypassed == other.pkp_bypassed &&
           displayed_password_field_on_http ==
               other.displayed_password_field_on_http &&
           displayed_credit_card_field_on_http ==
               other.displayed_credit_card_field_on_http);
 }
 
 }  // namespace security_state