Add --ignore-certificate-errors-spki-list switch and UMA histogram.

chrome/browser/io_thread.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/io_thread.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 1006 matching lines @@
         if (!quic_origin.IsEmpty())
           params->origins_to_force_quic_on.insert(quic_origin);
       }
     }
   }
 
   // Parameters only controlled by command line.
   if (command_line.HasSwitch(switches::kEnableUserAlternateProtocolPorts)) {
     params->enable_user_alternate_protocol_ports = true;
   }
+  if (command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList)) {
+    std::string spki_list = command_line.GetSwitchValueASCII(
+        switches::kIgnoreCertificateErrorsSPKIList);
+    for (const std::string& spki : base::SplitString(
+             spki_list, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) {
+      params->ignore_certificate_error_spki_list.insert(spki);

[Ryan Sleevi, 2017/03/16 23:19:13]

Should we validate this is parsable/correct? I'm just curious what we expect if
someone gives a bad string (like "foo") - is that surfaced as an error or just
silently accepted (and it would never match)?

[martinkr, 2017/03/28 23:16:02]

I don't feel strongly about it either way, but making the params field a set of
SHA256HashValue as you suggested below makes sense and resolves this.

+    }
+  }
+  UMA_HISTOGRAM_BOOLEAN(
+      "Net.Certificate.kIgnoreCertificateErrorsSPKIList",
+      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList));
   if (command_line.HasSwitch(switches::kIgnoreCertificateErrors)) {
     params->ignore_certificate_errors = true;
   }
   UMA_HISTOGRAM_BOOLEAN(
       "Net.Certificate.IgnoreErrors",
       command_line.HasSwitch(switches::kIgnoreCertificateErrors));
   if (command_line.HasSwitch(switches::kTestingFixedHttpPort)) {
     params->testing_fixed_http_port =
         GetSwitchValueAsInt(command_line, switches::kTestingFixedHttpPort);
   }
@@ skipping 75 matching lines @@
 
   // TODO(rtenneti): We should probably use HttpServerPropertiesManager for the
   // system URLRequestContext too. There's no reason this should be tied to a
   // profile.
   return context;
 }
 
 metrics::UpdateUsagePrefCallbackType IOThread::GetMetricsDataUseForwarder() {
   return base::Bind(&UpdateMetricsUsagePrefsOnUIThread);
 }