Add --ignore-certificate-errors-spki-list switch and UMA histogram.

chrome/browser/io_thread.cc

Index: chrome/browser/io_thread.cc
diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index 11a0084276f89521e4aac2d0632c93fdf5ad31ba..6b656aa78845c0e3cbcc798a5abe4566014c23eb 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -1024,6 +1024,17 @@ void IOThread::ConfigureParamsFromFieldTrialsAndCommandLine(
   if (command_line.HasSwitch(switches::kEnableUserAlternateProtocolPorts)) {
     params->enable_user_alternate_protocol_ports = true;
   }
+  if (command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList)) {
+    std::string spki_list = command_line.GetSwitchValueASCII(
+        switches::kIgnoreCertificateErrorsSPKIList);
+    for (const std::string& spki : base::SplitString(
+             spki_list, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) {
+      params->ignore_certificate_error_spki_list.insert(spki);

[Ryan Sleevi, 2017/03/16 23:19:13]

Should we validate this is parsable/correct? I'm just curious what we expect if
someone gives a bad string (like "foo") - is that surfaced as an error or just
silently accepted (and it would never match)?

[martinkr, 2017/03/28 23:16:02]

I don't feel strongly about it either way, but making the params field a set of
SHA256HashValue as you suggested below makes sense and resolves this.

+    }
+  }
+  UMA_HISTOGRAM_BOOLEAN(
+      "Net.Certificate.kIgnoreCertificateErrorsSPKIList",
+      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList));
   if (command_line.HasSwitch(switches::kIgnoreCertificateErrors)) {
     params->ignore_certificate_errors = true;
   }