Ensure the entire page is secure for PWAs.

chrome/browser/installable/installable_manager.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/installable/installable_manager.h"
 
 #include "base/bind.h"
 #include "base/strings/string_util.h"
 #include "chrome/browser/manifest/manifest_icon_downloader.h"
 #include "chrome/browser/manifest/manifest_icon_selector.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ssl/security_state_tab_helper.h"
+#include "components/security_state/core/security_state.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "net/base/url_util.h"
 #include "third_party/WebKit/public/platform/WebDisplayMode.h"
 
 namespace {
 
 const char kPngExtension[] = ".png";
 
 // This constant is the icon size on Android (48dp) multiplied by the scale
 // factor of a Nexus 5 device (3x). For mobile and desktop platforms, a 144px
 // icon is an approximate, appropriate lower bound. It is the currently
 // advertised minimum icon size for triggering banners.
@@ skipping 61 matching lines @@
 InstallableManager::InstallableManager(content::WebContents* web_contents)
     : content::WebContentsObserver(web_contents),
       manifest_(new ManifestProperty()),
       installable_(new InstallableProperty()),
       is_active_(false),
       weak_factory_(this) { }
 
 InstallableManager::~InstallableManager() = default;
 
 // static
+bool InstallableManager::IsContentSecure(content::WebContents* web_contents) {
+  if (!web_contents)
+    return false;
+
+  // Whitelist localhost. Check the VisibleURL to match what the
+  // SecurityStateTabHelper looks at.
+  if (net::IsLocalhost(web_contents->GetVisibleURL().HostNoBrackets()))

[benwells, 2017/01/13 04:34:13]

Hmm, it's a bit unfortunate you need to manually check this. Seems like
SecurityInfo should mark this SECURE automatically, or something.

[dominickn, 2017/01/13 04:38:54]

Yeah, that's what I expected too. Then it failed all of the tests (which use
localhost).

+    return true;
+
+  security_state::SecurityInfo security_info;
+  SecurityStateTabHelper::FromWebContents(web_contents)
+      ->GetSecurityInfo(&security_info);
+  return security_info.security_level == security_state::SECURE ||
+         security_info.security_level == security_state::EV_SECURE;
+}
+
+// static
 int InstallableManager::GetMinimumIconSizeInPx() {
   return kIconMinimumSizeInPx;
 }
 
 void InstallableManager::GetData(const InstallableParams& params,
                                  const InstallableCallback& callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   // Return immediately if we're already working on a task. The new task will be
   // looked at once the current task is finished.
@@ skipping 328 matching lines @@
   return manifest_->url;
 }
 
 const content::Manifest& InstallableManager::manifest() const {
   return manifest_->manifest;
 }
 
 bool InstallableManager::is_installable() const {
   return installable_->installable;
 }