Remove obsolete SHA-1 UX elements

components/security_state/core/security_state.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/core/security_state.h"
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
@@ skipping 66 matching lines @@
       // nonsecure defaults to neutral.
       status = NEUTRAL;
       level = NONE;
     }
   }
 
   UMA_HISTOGRAM_ENUMERATION(kEnumeration, status, LAST_STATUS);
   return level;
 }
 
-SHA1DeprecationStatus GetSHA1DeprecationStatus(
-    const VisibleSecurityState& visible_security_state) {
+bool GetSHA1InChain(const VisibleSecurityState& visible_security_state) {
   if (!visible_security_state.certificate ||
       !(visible_security_state.cert_status &
         net::CERT_STATUS_SHA1_SIGNATURE_PRESENT))
-    return NO_DEPRECATED_SHA1;
+    return false;
 
-  // The internal representation of the dates for UI treatment of SHA-1.
-  // See http://crbug.com/401365 for details.
-  static const int64_t kJanuary2017 = INT64_C(13127702400000000);
-  if (visible_security_state.certificate->valid_expiry() >=
-      base::Time::FromInternalValue(kJanuary2017))
-    return DEPRECATED_SHA1_MAJOR;
-  static const int64_t kJanuary2016 = INT64_C(13096080000000000);
-  if (visible_security_state.certificate->valid_expiry() >=
-      base::Time::FromInternalValue(kJanuary2016))
-    return DEPRECATED_SHA1_MINOR;
-
-  return NO_DEPRECATED_SHA1;
+  return true;

[estark, 2017/01/08 16:39:58]

nit: could simplify as

return visible_security_state.certificate && (visible_security_state.cert_status
& net::CERT_STATUS_SHA1_SIGNATURE_PRESENT);

Also I'd probably just inline this in the one callsite below and not split it
out into a separate function.

[elawrence, 2017/01/09 18:13:11]

Done.

 }
 
 ContentStatus GetContentStatus(bool displayed, bool ran) {
   if (ran && displayed)
     return CONTENT_STATUS_DISPLAYED_AND_RAN;
   if (ran)
     return CONTENT_STATUS_RAN;
   if (displayed)
     return CONTENT_STATUS_DISPLAYED;
   return CONTENT_STATUS_NONE;
 }
 
 SecurityLevel GetSecurityLevelForRequest(
     const VisibleSecurityState& visible_security_state,
     bool used_policy_installed_certificate,
     const IsOriginSecureCallback& is_origin_secure_callback,
-    SHA1DeprecationStatus sha1_status,
+    bool sha1_in_chain,
     ContentStatus mixed_content_status,
     ContentStatus content_with_cert_errors_status) {
   DCHECK(visible_security_state.connection_info_initialized ||
          visible_security_state.malicious_content_status !=
              MALICIOUS_CONTENT_STATUS_NONE);
 
   // Override the connection security information if the website failed the
   // browser's malware checks.
   if (visible_security_state.malicious_content_status !=
       MALICIOUS_CONTENT_STATUS_NONE) {
@@ skipping 32 matching lines @@
 
   // Report if there is a policy cert first, before reporting any other
   // authenticated-but-with-errors cases. A policy cert is a strong
   // indicator of a MITM being present (the enterprise), while the
   // other authenticated-but-with-errors indicate something may
   // be wrong, or may be wrong in the future, but is unclear now.
   if (used_policy_installed_certificate)
     return SECURE_WITH_POLICY_INSTALLED_CERT;
 
   // In most cases, SHA1 use is treated as a certificate error, in which case
-  // DANGEROUS will have been returned above. If SHA1 is permitted, we downgrade
-  // the security level to Neutral or Dangerous depending on policy.
-  if (sha1_status == DEPRECATED_SHA1_MAJOR ||
-      sha1_status == DEPRECATED_SHA1_MINOR) {
-    return (visible_security_state.display_sha1_from_local_anchors_as_neutral)
-               ? NONE
-               : DANGEROUS;
-  }
+  // DANGEROUS will have been returned above. If SHA1 was permitted by policy,
+  // downgrade the security level to Neutral.
+  if (sha1_in_chain)
+    return NONE;
 
   // Active mixed content is handled above.
   DCHECK_NE(CONTENT_STATUS_RAN, mixed_content_status);
   DCHECK_NE(CONTENT_STATUS_DISPLAYED_AND_RAN, mixed_content_status);
 
   if (mixed_content_status == CONTENT_STATUS_DISPLAYED ||
       content_with_cert_errors_status == CONTENT_STATUS_DISPLAYED) {
     return kDisplayedInsecureContentLevel;
   }
 
@@ skipping 16 matching lines @@
     const IsOriginSecureCallback& is_origin_secure_callback,
     SecurityInfo* security_info) {
   if (!visible_security_state.connection_info_initialized) {
     *security_info = SecurityInfo();
     security_info->malicious_content_status =
         visible_security_state.malicious_content_status;
     if (security_info->malicious_content_status !=
         MALICIOUS_CONTENT_STATUS_NONE) {
       security_info->security_level = GetSecurityLevelForRequest(
           visible_security_state, used_policy_installed_certificate,
-          is_origin_secure_callback, UNKNOWN_SHA1, CONTENT_STATUS_UNKNOWN,
+          is_origin_secure_callback, false, CONTENT_STATUS_UNKNOWN,
           CONTENT_STATUS_UNKNOWN);
     }
     return;
   }
   security_info->certificate = visible_security_state.certificate;
-  security_info->sha1_deprecation_status =
-      GetSHA1DeprecationStatus(visible_security_state);
+  security_info->sha1_in_chain = GetSHA1InChain(visible_security_state);
   security_info->mixed_content_status =
       GetContentStatus(visible_security_state.displayed_mixed_content,
                        visible_security_state.ran_mixed_content);
   security_info->content_with_cert_errors_status = GetContentStatus(
       visible_security_state.displayed_content_with_cert_errors,
       visible_security_state.ran_content_with_cert_errors);
   security_info->security_bits = visible_security_state.security_bits;
   security_info->connection_status = visible_security_state.connection_status;
   security_info->key_exchange_group = visible_security_state.key_exchange_group;
   security_info->cert_status = visible_security_state.cert_status;
   security_info->scheme_is_cryptographic =
       visible_security_state.url.SchemeIsCryptographic();
   security_info->obsolete_ssl_status =
       net::ObsoleteSSLStatus(security_info->connection_status);
   security_info->pkp_bypassed = visible_security_state.pkp_bypassed;
   security_info->sct_verify_statuses =
       visible_security_state.sct_verify_statuses;
 
   security_info->malicious_content_status =
       visible_security_state.malicious_content_status;
 
   security_info->displayed_password_field_on_http =
       visible_security_state.displayed_password_field_on_http;
   security_info->displayed_credit_card_field_on_http =
       visible_security_state.displayed_credit_card_field_on_http;
 
   security_info->security_level = GetSecurityLevelForRequest(
       visible_security_state, used_policy_installed_certificate,
-      is_origin_secure_callback, security_info->sha1_deprecation_status,
+      is_origin_secure_callback, security_info->sha1_in_chain,
       security_info->mixed_content_status,
       security_info->content_with_cert_errors_status);
 }
 
 }  // namespace
 
 const base::Feature kHttpFormWarningFeature{"HttpFormWarning",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
 SecurityInfo::SecurityInfo()
     : security_level(NONE),
       malicious_content_status(MALICIOUS_CONTENT_STATUS_NONE),
-      sha1_deprecation_status(NO_DEPRECATED_SHA1),
+      sha1_in_chain(false),
       mixed_content_status(CONTENT_STATUS_NONE),
       content_with_cert_errors_status(CONTENT_STATUS_NONE),
       scheme_is_cryptographic(false),
       cert_status(0),
       security_bits(-1),
       connection_status(0),
       key_exchange_group(0),
       obsolete_ssl_status(net::OBSOLETE_SSL_NONE),
       pkp_bypassed(false),
       displayed_password_field_on_http(false),
@@ skipping 21 matching lines @@
       cert_status(0),
       connection_status(0),
       key_exchange_group(0),
       security_bits(-1),
       displayed_mixed_content(false),
       ran_mixed_content(false),
       displayed_content_with_cert_errors(false),
       ran_content_with_cert_errors(false),
       pkp_bypassed(false),
       displayed_password_field_on_http(false),
-      displayed_credit_card_field_on_http(false),
-      display_sha1_from_local_anchors_as_neutral(false) {}
+      displayed_credit_card_field_on_http(false) {}
 
 VisibleSecurityState::~VisibleSecurityState() {}
 
 bool VisibleSecurityState::operator==(const VisibleSecurityState& other) const {
   return (url == other.url &&
           malicious_content_status == other.malicious_content_status &&
           !!certificate == !!other.certificate &&
           (certificate ? certificate->Equals(other.certificate.get()) : true) &&
           connection_status == other.connection_status &&
           key_exchange_group == other.key_exchange_group &&
           security_bits == other.security_bits &&
           sct_verify_statuses == other.sct_verify_statuses &&
           displayed_mixed_content == other.displayed_mixed_content &&
           ran_mixed_content == other.ran_mixed_content &&
           displayed_content_with_cert_errors ==
               other.displayed_content_with_cert_errors &&
           ran_content_with_cert_errors == other.ran_content_with_cert_errors &&
           pkp_bypassed == other.pkp_bypassed &&
           displayed_password_field_on_http ==
               other.displayed_password_field_on_http &&
           displayed_credit_card_field_on_http ==
-              other.displayed_credit_card_field_on_http &&
-          display_sha1_from_local_anchors_as_neutral ==
-              other.display_sha1_from_local_anchors_as_neutral);
+              other.displayed_credit_card_field_on_http);
 }
 
 }  // namespace security_state