Display "Not secure" verbose state for data: URLs

components/security_state/core/security_state_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/core/security_state.h"
 
 #include <stdint.h>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 16 matching lines @@
 const char kHttpUrl[] = "http://foo.test/";
 
 bool IsOriginSecure(const GURL& url) {
   return url == kHttpsUrl;
 }
 
 class TestSecurityStateHelper {
  public:
   TestSecurityStateHelper()
       : url_(kHttpsUrl),
+        cert_(net::ImportCertFromFile(net::GetTestCertsDirectory(),
+                                      "sha1_2016.pem")),
         connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2
                            << net::SSL_CONNECTION_VERSION_SHIFT),
         cert_status_(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT),
         displayed_mixed_content_(false),
         ran_mixed_content_(false),
         malicious_content_status_(MALICIOUS_CONTENT_STATUS_NONE),
         displayed_password_field_on_http_(false),
-        displayed_credit_card_field_on_http_(false) {
-    cert_ =
-        net::ImportCertFromFile(net::GetTestCertsDirectory(), "sha1_2016.pem");
-  }
+        displayed_credit_card_field_on_http_(false) {}
   virtual ~TestSecurityStateHelper() {}
 
   void set_connection_status(int connection_status) {
     connection_status_ = connection_status;
   }
   void SetCipherSuite(uint16_t ciphersuite) {
     net::SSLConnectionStatusSetCipherSuite(ciphersuite, &connection_status_);
   }
   void AddCertStatus(net::CertStatus cert_status) {
     cert_status_ |= cert_status;
@@ skipping 10 matching lines @@
   }
   void set_displayed_password_field_on_http(
       bool displayed_password_field_on_http) {
     displayed_password_field_on_http_ = displayed_password_field_on_http;
   }
   void set_displayed_credit_card_field_on_http(
       bool displayed_credit_card_field_on_http) {
     displayed_credit_card_field_on_http_ = displayed_credit_card_field_on_http;
   }
 
-  void UseHttpUrl() { url_ = GURL(kHttpUrl); }
+  void SetUrl(const GURL& url) { url_ = url; }
 
-  std::unique_ptr<VisibleSecurityState> GetVisibleSecurityState() {
+  std::unique_ptr<VisibleSecurityState> GetVisibleSecurityState() const {
     auto state = base::MakeUnique<VisibleSecurityState>();
     state->connection_info_initialized = true;
     state->url = url_;
     state->certificate = cert_;
     state->cert_status = cert_status_;
     state->connection_status = connection_status_;
     state->security_bits = 256;
     state->displayed_mixed_content = displayed_mixed_content_;
     state->ran_mixed_content = ran_mixed_content_;
     state->malicious_content_status = malicious_content_status_;
     state->displayed_password_field_on_http = displayed_password_field_on_http_;
     state->displayed_credit_card_field_on_http =
         displayed_credit_card_field_on_http_;
     return state;
   }
 
-  void GetSecurityInfo(SecurityInfo* security_info) {
+  void GetSecurityInfo(SecurityInfo* security_info) const {
     security_state::GetSecurityInfo(
         GetVisibleSecurityState(),
         false /* used policy installed certificate */,
         base::Bind(&IsOriginSecure), security_info);
   }
 
  private:
   GURL url_;
-  scoped_refptr<net::X509Certificate> cert_;
+  const scoped_refptr<net::X509Certificate> cert_;
   int connection_status_;
   net::CertStatus cert_status_;
   bool displayed_mixed_content_;
   bool ran_mixed_content_;
   MaliciousContentStatus malicious_content_status_;
   bool displayed_password_field_on_http_;
   bool displayed_credit_card_field_on_http_;
 };
 
 }  // namespace
@@ skipping 122 matching lines @@
   TestSecurityStateHelper helper;
   helper.set_malicious_content_status(
       MALICIOUS_CONTENT_STATUS_SOCIAL_ENGINEERING);
   SecurityInfo security_info;
   helper.GetSecurityInfo(&security_info);
   EXPECT_EQ(MALICIOUS_CONTENT_STATUS_SOCIAL_ENGINEERING,
             security_info.malicious_content_status);
   EXPECT_EQ(DANGEROUS, security_info.security_level);
 }
 
+// Tests that pseudo URLs always cause an HTTP_SHOW_WARNING to be shown,
+// regardless of whether a password or credit card field was displayed.
+TEST(SecurityStateTest, AlwaysWarnOnDataUrls) {
+  TestSecurityStateHelper helper;
+  helper.SetUrl(GURL("data:text/html,<html>test</html>"));
+  helper.set_displayed_password_field_on_http(false);
+  helper.set_displayed_credit_card_field_on_http(false);
+  SecurityInfo security_info;
+  helper.GetSecurityInfo(&security_info);
+  EXPECT_FALSE(security_info.displayed_password_field_on_http);
+  EXPECT_FALSE(security_info.displayed_credit_card_field_on_http);
+  EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level);
+}
+
 // Tests that password fields cause the security level to be downgraded
 // to HTTP_SHOW_WARNING when the command-line switch is set.
 TEST(SecurityStateTest, PasswordFieldWarning) {
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip);
   TestSecurityStateHelper helper;
-  helper.UseHttpUrl();
+  helper.SetUrl(GURL(kHttpUrl));
   helper.set_displayed_password_field_on_http(true);
   SecurityInfo security_info;
   helper.GetSecurityInfo(&security_info);
   EXPECT_TRUE(security_info.displayed_password_field_on_http);
   EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level);
 }
 
 // Tests that credit card fields cause the security level to be downgraded
 // to HTTP_SHOW_WARNING when the command-line switch is set.
 TEST(SecurityStateTest, CreditCardFieldWarning) {
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip);
   TestSecurityStateHelper helper;
-  helper.UseHttpUrl();
+  helper.SetUrl(GURL(kHttpUrl));
   helper.set_displayed_credit_card_field_on_http(true);
   SecurityInfo security_info;
   helper.GetSecurityInfo(&security_info);
   EXPECT_TRUE(security_info.displayed_credit_card_field_on_http);
   EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level);
 }
 
 // Tests that neither |displayed_password_field_on_http| nor
 // |displayed_credit_card_field_on_http| is set when the corresponding
 // VisibleSecurityState flags are not set.
 TEST(SecurityStateTest, PrivateUserDataNotSet) {
   TestSecurityStateHelper helper;
-  helper.UseHttpUrl();
+  helper.SetUrl(GURL(kHttpUrl));
   SecurityInfo security_info;
   helper.GetSecurityInfo(&security_info);
   EXPECT_FALSE(security_info.displayed_password_field_on_http);
   EXPECT_FALSE(security_info.displayed_credit_card_field_on_http);
   EXPECT_EQ(NONE, security_info.security_level);
 }
 
 // Tests that SSL.MarkHttpAsStatus histogram is updated when security state is
 // computed for a page.
 TEST(SecurityStateTest, MarkHttpAsStatusHistogram) {
   const char* kHistogramName = "SSL.MarkHttpAsStatus";
   base::HistogramTester histograms;
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip);
   TestSecurityStateHelper helper;
-  helper.UseHttpUrl();
+  helper.SetUrl(GURL(kHttpUrl));
 
   // Ensure histogram recorded correctly when a non-secure password input is
   // found on the page.
   helper.set_displayed_password_field_on_http(true);
   SecurityInfo security_info;
   histograms.ExpectTotalCount(kHistogramName, 0);
   helper.GetSecurityInfo(&security_info);
   histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 1);
 
   // Ensure histogram recorded correctly even without a password input.
   helper.set_displayed_password_field_on_http(false);
   helper.GetSecurityInfo(&security_info);
   histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 2);
 }
 
 }  // namespace security_state