Implement 'Not secure' warning for non-secure pages in Incognito mode

components/security_state/core/security_state.h

Index: components/security_state/core/security_state.h
diff --git a/components/security_state/core/security_state.h b/components/security_state/core/security_state.h
index 4d1ec3f90ce375ebc0be84fb98e6c0d4406cc319..8696f1e7bfd5af8673a8eae1b9350a10077c63d1 100644
--- a/components/security_state/core/security_state.h
+++ b/components/security_state/core/security_state.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_SECURITY_STATE_SECURITY_STATE_H_
-#define COMPONENTS_SECURITY_STATE_SECURITY_STATE_H_
+#ifndef COMPONENTS_SECURITY_STATE_CORE_SECURITY_STATE_H_
+#define COMPONENTS_SECURITY_STATE_CORE_SECURITY_STATE_H_
 
 #include <stdint.h>
 #include <memory>
@@ -141,6 +141,8 @@ struct SecurityInfo {
   // True if the server's certificate does not contain a
   // subjectAltName extension with a domain name or IP address.
   bool cert_missing_subject_alt_name;
+  // True if the page was displayed in an Incognito context.
+  bool is_incognito;

[estark, 2017/06/13 22:47:11]

optional nit: it might be more useful to have this field be
|did_warn_for_incognito|, and only set it to true when we actually set
HTTP_SHOW_WARNING because of incognito. That way, the consumers of this field
don't have to know to also check for IsHttpWarningForIncognitoEnabled() and it
doesn't have to be part of the public interface

[elawrence, 2017/06/14 17:01:39]

This is now |incognito_downgraded_security_level| and it does indeed make
various things simpler.

 };
 
 // Contains the security state relevant to computing the SecurityInfo
@@ -181,6 +183,8 @@ struct VisibleSecurityState {
   bool displayed_password_field_on_http;
   // True if the page was an HTTP page that displayed a credit card field.
   bool displayed_credit_card_field_on_http;
+  // True if the page was displayed in an Incognito context.
+  bool is_incognito;
 };
 
 // These security levels describe the treatment given to pages that
@@ -209,6 +213,10 @@ void GetSecurityInfo(
 // |kHttpFormWarningFeature| feature.
 bool IsHttpWarningInFormEnabled();
 
+// Returns true if the MarkHttpAs setting indicates that a warning
+// should be shown for HTTP pages loaded while in Incognito mode.
+bool IsHttpWarningForIncognitoEnabled();
+
 }  // namespace security_state
 
-#endif  // COMPONENTS_SECURITY_STATE_SECURITY_STATE_H_
+#endif  // COMPONENTS_SECURITY_STATE_CORE_SECURITY_STATE_H_