Ensure GetSecurityStyle sets correct explanations for HTTP_SHOW_WARNING

components/security_state/content/content_utils.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/content/content_utils.h"
 
 #include <string>
 #include <vector>
 
 #include "base/memory/ptr_util.h"
@@ skipping 166 matching lines @@
 
   return state;
 }
 
 blink::WebSecurityStyle GetSecurityStyle(
     const security_state::SecurityInfo& security_info,
     content::SecurityStyleExplanations* security_style_explanations) {
   const blink::WebSecurityStyle security_style =
       SecurityLevelToSecurityStyle(security_info.security_level);
 
-  if (security_info.security_level == security_state::HTTP_SHOW_WARNING) {
-    // If the HTTP_SHOW_WARNING field trial is in use, display an
-    // unauthenticated explanation explaining why the omnibox warning is
-    // present.
+  // The HTTP_SHOW_WARNING state may occur if the page is served as a data: URI
+  // or if it is served non-securely AND contains a sensitive form field.
+  if (security_info.security_level == security_state::HTTP_SHOW_WARNING &&
+      (security_info.displayed_password_field_on_http ||
+       security_info.displayed_credit_card_field_on_http)) {
+    // Display an unauthenticated explanation explaining why the omnibox warning

[estark, 2017/03/02 22:53:33]

optional nit: I don't think this comment is helpful, as it pretty much just
restates the code.

[elawrence, 2017/03/02 23:11:43]

Done.

+    // is present.
     security_style_explanations->unauthenticated_explanations.push_back(
         content::SecurityStyleExplanation(
             l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT),
             l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT_DESCRIPTION)));
-  } else if (security_info.security_level == security_state::NONE &&
-             (security_info.displayed_password_field_on_http ||
-              security_info.displayed_credit_card_field_on_http)) {
-    // If the HTTP_SHOW_WARNING field trial isn't in use yet, display an
-    // informational note that the omnibox will contain a warning for
-    // this site in a future version of Chrome.
-    security_style_explanations->info_explanations.push_back(
-        content::SecurityStyleExplanation(
-            l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT),
-            l10n_util::GetStringUTF8(
-                IDS_PRIVATE_USER_DATA_INPUT_FUTURE_DESCRIPTION)));
   }
-
   security_style_explanations->ran_insecure_content_style =
       SecurityLevelToSecurityStyle(security_state::kRanInsecureContentLevel);
   security_style_explanations->displayed_insecure_content_style =
       SecurityLevelToSecurityStyle(
           security_state::kDisplayedInsecureContentLevel);
 
   if (security_info.malicious_content_status !=
       security_state::MALICIOUS_CONTENT_STATUS_NONE) {
     security_style_explanations->summary =
         l10n_util::GetStringUTF8(IDS_SAFEBROWSING_WARNING);
@@ skipping 92 matching lines @@
     security_style_explanations->info_explanations.push_back(
         content::SecurityStyleExplanation(
             "Public-Key Pinning Bypassed",
             "Public-key pinning was bypassed by a local root certificate."));
   }
 
   return security_style;
 }
 
 }  // namespace security_state