Mark SHA-1 as deprecated

chrome/browser/ui/website_settings/website_settings.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/website_settings/website_settings.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 344 matching lines @@
   }
 
   cert_id_ = ssl.cert_id;
 
   if (ssl.cert_id && !ssl.signed_certificate_timestamp_ids.empty()) {
     signed_certificate_timestamp_ids_.assign(
         ssl.signed_certificate_timestamp_ids.begin(),
         ssl.signed_certificate_timestamp_ids.end());
   }
 
-  if (ssl.cert_id &&
-      cert_store_->RetrieveCert(ssl.cert_id, &cert) &&
+  bool was_ssl = ssl.cert_id && cert_store_->RetrieveCert(ssl.cert_id, &cert);
+  bool was_ssl_clean_or_minor_errors =
+      was_ssl &&
       (!net::IsCertStatusError(ssl.cert_status) ||
-       net::IsCertStatusMinorError(ssl.cert_status))) {
+       net::IsCertStatusMinorError(ssl.cert_status));
+  bool was_ssl_using_deprecated_algorithm =
+      was_ssl_clean_or_minor_errors &&
+      (ssl.cert_status & net::CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM);
+
+  if (was_ssl_clean_or_minor_errors) {
     // There are no major errors. Check for minor errors.
 #if defined(OS_CHROMEOS)
     policy::PolicyCertService* service =
         policy::PolicyCertServiceFactory::GetForProfile(profile);
     const bool used_policy_certs = service && service->UsedPolicyCertificates();
 #else
     const bool used_policy_certs = false;
 #endif
     if (used_policy_certs) {
       site_identity_status_ = SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT;
       site_identity_details_ = l10n_util::GetStringFUTF16(
           IDS_CERT_POLICY_PROVIDED_CERT_MESSAGE, UTF8ToUTF16(url.host()));
-    } else if (net::IsCertStatusMinorError(ssl.cert_status)) {
+    } else if (net::IsCertStatusMinorError(ssl.cert_status) &&
+               (ssl.cert_status & net::CERT_STATUS_ALL_ERRORS) !=
+                   net::CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM) {
       site_identity_status_ = SITE_IDENTITY_STATUS_CERT_REVOCATION_UNKNOWN;
       base::string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
       if (issuer_name.empty()) {
         issuer_name.assign(l10n_util::GetStringUTF16(
             IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
       }
 
       site_identity_details_.assign(l10n_util::GetStringFUTF16(
           GetSiteIdentityDetailsMessageByCTInfo(
               ssl.signed_certificate_timestamp_ids, false /* not EV */),
           issuer_name));
 
       site_identity_details_ += ASCIIToUTF16("\n\n");
       if (ssl.cert_status & net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION) {
         site_identity_details_ += l10n_util::GetStringUTF16(
             IDS_PAGE_INFO_SECURITY_TAB_UNABLE_TO_CHECK_REVOCATION);
       } else if (ssl.cert_status & net::CERT_STATUS_NO_REVOCATION_MECHANISM) {
         site_identity_details_ += l10n_util::GetStringUTF16(
             IDS_PAGE_INFO_SECURITY_TAB_NO_REVOCATION_MECHANISM);
       } else {
         NOTREACHED() << "Need to specify string for this warning";
       }
-    } else if (ssl.cert_status & net::CERT_STATUS_IS_EV) {
-      // EV HTTPS page.
-      site_identity_status_ = GetSiteIdentityStatusByCTInfo(
-          ssl.signed_certificate_timestamp_ids, true);
-      DCHECK(!cert->subject().organization_names.empty());
-      organization_name_ = UTF8ToUTF16(cert->subject().organization_names[0]);
-      // An EV Cert is required to have a city (localityName) and country but
-      // state is "if any".
-      DCHECK(!cert->subject().locality_name.empty());
-      DCHECK(!cert->subject().country_name.empty());
-      base::string16 locality;
-      if (!cert->subject().state_or_province_name.empty()) {
-        locality = l10n_util::GetStringFUTF16(
-            IDS_PAGEINFO_ADDRESS,
-            UTF8ToUTF16(cert->subject().locality_name),
-            UTF8ToUTF16(cert->subject().state_or_province_name),
-            UTF8ToUTF16(cert->subject().country_name));
+    } else {
+      DCHECK(!net::IsCertStatusError(ssl.cert_status) ||
+             (ssl.cert_status & net::CERT_STATUS_ALL_ERRORS) ==
+                 net::CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM);
+      if (ssl.cert_status & net::CERT_STATUS_IS_EV) {
+        // EV HTTPS page.
+        site_identity_status_ = GetSiteIdentityStatusByCTInfo(
+            ssl.signed_certificate_timestamp_ids, true);
+        DCHECK(!cert->subject().organization_names.empty());
+        organization_name_ = UTF8ToUTF16(cert->subject().organization_names[0]);
+        // An EV Cert is required to have a city (localityName) and country but
+        // state is "if any".
+        DCHECK(!cert->subject().locality_name.empty());
+        DCHECK(!cert->subject().country_name.empty());
+        base::string16 locality;
+        if (!cert->subject().state_or_province_name.empty()) {
+          locality = l10n_util::GetStringFUTF16(
+              IDS_PAGEINFO_ADDRESS,
+              UTF8ToUTF16(cert->subject().locality_name),
+              UTF8ToUTF16(cert->subject().state_or_province_name),
+              UTF8ToUTF16(cert->subject().country_name));
+        } else {
+          locality = l10n_util::GetStringFUTF16(
+              IDS_PAGEINFO_PARTIAL_ADDRESS,
+              UTF8ToUTF16(cert->subject().locality_name),
+              UTF8ToUTF16(cert->subject().country_name));
+        }
+        DCHECK(!cert->subject().organization_names.empty());
+        site_identity_details_.assign(l10n_util::GetStringFUTF16(
+            GetSiteIdentityDetailsMessageByCTInfo(
+                ssl.signed_certificate_timestamp_ids, true /* is EV */),
+            UTF8ToUTF16(cert->subject().organization_names[0]),
+            locality,
+            UTF8ToUTF16(cert->issuer().GetDisplayName())));
       } else {
-        locality = l10n_util::GetStringFUTF16(
-            IDS_PAGEINFO_PARTIAL_ADDRESS,
-            UTF8ToUTF16(cert->subject().locality_name),
-            UTF8ToUTF16(cert->subject().country_name));
+        // Non-EV OK HTTPS page.
+        site_identity_status_ = GetSiteIdentityStatusByCTInfo(
+            ssl.signed_certificate_timestamp_ids, false);
+        base::string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
+        if (issuer_name.empty()) {
+          issuer_name.assign(l10n_util::GetStringUTF16(
+              IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
+        }
+
+        site_identity_details_.assign(l10n_util::GetStringFUTF16(
+            GetSiteIdentityDetailsMessageByCTInfo(
+                ssl.signed_certificate_timestamp_ids, false /* not EV */),
+            issuer_name));
       }
-      DCHECK(!cert->subject().organization_names.empty());
-      site_identity_details_.assign(l10n_util::GetStringFUTF16(
-          GetSiteIdentityDetailsMessageByCTInfo(
-              ssl.signed_certificate_timestamp_ids, true /* is EV */),
-          UTF8ToUTF16(cert->subject().organization_names[0]),
-          locality,
-          UTF8ToUTF16(cert->issuer().GetDisplayName())));
-    } else {
-      // Non-EV OK HTTPS page.
-      site_identity_status_ = GetSiteIdentityStatusByCTInfo(
-          ssl.signed_certificate_timestamp_ids, false);
-      base::string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
-      if (issuer_name.empty()) {
-        issuer_name.assign(l10n_util::GetStringUTF16(
-            IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
+      if (was_ssl_using_deprecated_algorithm) {
+        site_identity_status_ =
+            SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM;
+        site_identity_details_ += UTF8ToUTF16("\n\n");
+        site_identity_details_ += l10n_util::GetStringUTF16(
+            IDS_PAGE_INFO_SECURITY_TAB_DEPRECATED_SIGNATURE_ALGORITHM);
       }
-
-      site_identity_details_.assign(l10n_util::GetStringFUTF16(
-          GetSiteIdentityDetailsMessageByCTInfo(
-              ssl.signed_certificate_timestamp_ids, false /* not EV */),
-          issuer_name));
     }
   } else {
     // HTTP or HTTPS with errors (not warnings).
     site_identity_details_.assign(l10n_util::GetStringUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_INSECURE_IDENTITY));
     if (ssl.security_style == content::SECURITY_STYLE_UNAUTHENTICATED)
       site_identity_status_ = SITE_IDENTITY_STATUS_NO_CERT;
     else
       site_identity_status_ = SITE_IDENTITY_STATUS_ERROR;
 
@@ skipping 284 matching lines @@
   if (visited_before_today) {
     first_visit_text = l10n_util::GetStringFUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_VISITED_BEFORE_TODAY,
         base::TimeFormatShortDate(first_visit));
   } else {
     first_visit_text = l10n_util::GetStringUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_FIRST_VISITED_TODAY);
   }
   ui_->SetFirstVisit(first_visit_text);
 }