Implement 'Not secure' warning for non-secure pages in Incognito mode

components/security_state/content/content_utils_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/content/content_utils.h"
 
+#include <vector>
+
 #include "base/command_line.h"
 #include "base/test/histogram_tester.h"
 #include "components/security_state/core/security_state.h"
 #include "components/security_state/core/switches.h"
 #include "content/public/browser/security_style_explanation.h"
 #include "content/public/browser/security_style_explanations.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/test/cert_test_util.h"
@@ skipping 229 matching lines @@
 
   // Check that when both password and credit card fields get displayed, only
   // one explanation is added.
   explanations.neutral_explanations.clear();
   security_info.displayed_credit_card_field_on_http = true;
   security_info.displayed_password_field_on_http = true;
   security_style = GetSecurityStyle(security_info, &explanations);
   EXPECT_EQ(blink::kWebSecurityStyleNeutral, security_style);
   // Verify only one explanation was shown when Form Not Secure is triggered.
   EXPECT_EQ(1u, explanations.neutral_explanations.size());
+
+  // Verify that two explanations are shown when the Incognito and
+  // FormNotSecure flags are both set.
+  explanations.neutral_explanations.clear();
+  security_info.displayed_credit_card_field_on_http = true;
+  security_info.incognito_downgraded_security_level = true;
+  security_style = GetSecurityStyle(security_info, &explanations);
+  EXPECT_EQ(blink::kWebSecurityStyleNeutral, security_style);
+  EXPECT_EQ(2u, explanations.neutral_explanations.size());
 }
 
 // Tests that an explanation is provided if a certificate is missing a
 // subjectAltName extension containing a domain name or IP address.
 TEST(SecurityStateContentUtilsTest, SubjectAltNameWarning) {
   security_state::SecurityInfo security_info;
   security_info.cert_status = 0;
   security_info.scheme_is_cryptographic = true;
 
   security_info.certificate = net::ImportCertFromFile(
       net::GetTestCertsDirectory(), "salesforce_com_test.pem");
   ASSERT_TRUE(security_info.certificate);
 
   content::SecurityStyleExplanations explanations;
   security_info.cert_missing_subject_alt_name = true;
   GetSecurityStyle(security_info, &explanations);
   // Verify that an explanation was shown for a missing subjectAltName.
   EXPECT_EQ(1u, explanations.insecure_explanations.size());
 
   explanations.insecure_explanations.clear();
   security_info.cert_missing_subject_alt_name = false;
   GetSecurityStyle(security_info, &explanations);
   // Verify that no explanation is shown if the subjectAltName is present.
   EXPECT_EQ(0u, explanations.insecure_explanations.size());
 }
 
 }  // namespace