Experience sampling instrumentation for dangerous downloads warnings

chrome/browser/ui/views/download/download_item_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/download/download_item_view.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/i18n/break_iterator.h"
 #include "base/i18n/rtl.h"
 #include "base/metrics/histogram.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/download/chrome_download_manager_delegate.h"
 #include "chrome/browser/download/download_item_model.h"
 #include "chrome/browser/download/download_stats.h"
 #include "chrome/browser/download/drag_download_item.h"
+#include "chrome/browser/extensions/api/experience_sampling_private/experience_sampling.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/download_feedback_service.h"
 #include "chrome/browser/safe_browsing/download_protection_service.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/themes/theme_properties.h"
 #include "chrome/browser/ui/views/download/download_feedback_dialog_view.h"
 #include "chrome/browser/ui/views/download/download_shelf_context_menu_view.h"
 #include "chrome/browser/ui/views/download/download_shelf_view.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "content/public/browser/download_danger_type.h"
@@ skipping 11 matching lines @@
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/text_elider.h"
 #include "ui/gfx/text_utils.h"
 #include "ui/views/controls/button/label_button.h"
 #include "ui/views/controls/label.h"
 #include "ui/views/mouse_constants.h"
 #include "ui/views/widget/root_view.h"
 #include "ui/views/widget/widget.h"
 
 using content::DownloadItem;
+using extensions::ExperienceSamplingEvent;
 
 // TODO(paulg): These may need to be adjusted when download progress
 //              animation is added, and also possibly to take into account
 //              different screen resolutions.
 static const int kTextWidth = 140;            // Pixels
 static const int kDangerousTextWidth = 200;   // Pixels
 static const int kVerticalPadding = 3;        // Pixels
 static const int kVerticalTextPadding = 2;    // Pixels
 static const int kTooltipMaxWidth = 800;      // Pixels
 
@@ skipping 18 matching lines @@
 
 // How long we keep the item disabled after the user clicked it to open the
 // downloaded item.
 static const int kDisabledOnOpenDuration = 3000;
 
 // Darken light-on-dark download status text by 20% before drawing, thus
 // creating a "muted" version of title text for both dark-on-light and
 // light-on-dark themes.
 static const double kDownloadItemLuminanceMod = 0.8;
 
+// Constants for the Experience Sampling instrumentation.
+const char kEventNameMalicious[] = "download_warning_malicious";

[msw, 2014/08/13 20:11:37]

These string constants should be shared between Cocoa and Views.
Are we doing the same thing for Android and iOS? Ditto there then.

[Chris Thompson, 2014/08/13 21:18:00]

Done. Moved these to experience_sampling.h.

+const char kEventNameDangerous[] = "download_warning_dangerous";
+
 namespace {
 
 // Callback for DownloadShelf paint functions to mirror the progress animation
 // in RTL locales.
 void RTLMirrorXForView(views::View* containing_view, gfx::Rect* bounds) {
   bounds->set_x(containing_view->GetMirroredXForRect(*bounds));
 }
 
 }  // namespace
 
@@ skipping 118 matching lines @@
 
   SetAccessibilityFocusable(true);
 
   OnDownloadUpdated(download());
   UpdateDropDownButtonPosition();
 }
 
 DownloadItemView::~DownloadItemView() {
   StopDownloadProgress();
   download()->RemoveObserver(this);
+
+  // Experience Sampling: If the user took no action to remove the warning

[msw, 2014/08/13 20:11:37]

What's the use for this info? Wouldn't allow/deny/ignore be more informative?

[Chris Thompson, 2014/08/13 21:18:00]

Changed this to "ignore".

+  // before it disappeared, then the user effectively dismissed the download
+  // without keeping it.
+  if (mode_ == DANGEROUS_MODE || mode_ == MALICIOUS_MODE)
+    sampling_event_->CreateUserDecisionEvent(ExperienceSamplingEvent::kDeny);
 }
 
 // Progress animation handlers.
 
 void DownloadItemView::UpdateDownloadProgress() {
   progress_angle_ =
       (progress_angle_ + DownloadShelf::kUnknownIncrementDegrees) %
       DownloadShelf::kMaxDegrees;
   SchedulePaint();
 }
@@ skipping 877 matching lines @@
 
 void DownloadItemView::ClearWarningDialog() {
   DCHECK(download()->GetDangerType() ==
          content::DOWNLOAD_DANGER_TYPE_USER_VALIDATED);
   DCHECK(mode_ == DANGEROUS_MODE || mode_ == MALICIOUS_MODE);
 
   mode_ = NORMAL_MODE;
   body_state_ = NORMAL;
   drop_down_state_ = NORMAL;
 
+  // ExperienceSampling: User proceeded through the warning.

[msw, 2014/08/13 20:11:37]

Use "Experience Sampling" or "ExperienceSampling" consistently everywhere.

[Chris Thompson, 2014/08/13 21:18:00]

Done. s/Experience Sampling/ExperienceSampling/g

+  sampling_event_->CreateUserDecisionEvent(ExperienceSamplingEvent::kProceed);
+
   // Remove the views used by the warning dialog.
   if (save_button_) {
     RemoveChildView(save_button_);
     delete save_button_;
     save_button_ = NULL;
   }
   RemoveChildView(discard_button_);
   delete discard_button_;
   discard_button_ = NULL;
   RemoveChildView(dangerous_download_label_);
@@ skipping 23 matching lines @@
   content::DownloadDangerType danger_type = download()->GetDangerType();
   RecordDangerousDownloadWarningShown(danger_type);
 #if defined(FULL_SAFE_BROWSING)
   if (model_.ShouldAllowDownloadFeedback()) {
     safe_browsing::DownloadFeedbackService::RecordEligibleDownloadShown(
         danger_type);
   }
 #endif
   mode_ = model_.MightBeMalicious() ? MALICIOUS_MODE : DANGEROUS_MODE;
 
+  // ExperienceSampling: Dangerous or malicious download warning is being shown
+  // to the user, so we start a new SamplingEvent and track it.
+  std::string event_name = model_.MightBeMalicious() ?
+      kEventNameMalicious
+      : kEventNameDangerous;

[msw, 2014/08/13 20:11:37]

This formatting is incorrect, use "git cl format"
https://code.google.com/p/chromium/wiki/ClangFormat
I'd probably just combine this line with the one above.

[Chris Thompson, 2014/08/13 21:18:00]

Done. Missed this in an edit that shortened the line.

+  sampling_event_.reset(new ExperienceSamplingEvent(

[msw, 2014/08/13 20:11:37]

Yikes, I really hope this has undergone security review...

[Chris Thompson, 2014/08/13 21:18:00]

Do you have particular concerns about this use of scoped_ptr here?

[msw, 2014/08/14 01:48:33]

No, my point was more about reporting url, referrer, and browser context info to
some extension. You whitelisting explanation addressed my security concerns.

+      event_name,
+      download()->GetURL(),
+      download()->GetReferrerUrl(),
+      download()->GetBrowserContext()));
+
   body_state_ = NORMAL;
   drop_down_state_ = NORMAL;
   if (mode_ == DANGEROUS_MODE) {
     save_button_ = new views::LabelButton(
         this, model_.GetWarningConfirmButtonText());
     save_button_->SetStyle(views::Button::STYLE_BUTTON);
     AddChildView(save_button_);
   }
   int discard_button_message = model_.IsMalicious() ?
       IDS_DISMISS_DOWNLOAD : IDS_DISCARD_DOWNLOAD;
@@ skipping 173 matching lines @@
 void DownloadItemView::AnimateStateTransition(State from, State to,
                                               gfx::SlideAnimation* animation) {
   if (from == NORMAL && to == HOT) {
     animation->Show();
   } else if (from == HOT && to == NORMAL) {
     animation->Hide();
   } else if (from != to) {
     animation->Reset((to == HOT) ? 1.0 : 0.0);
   }
 }