Add field trial and flag to mark HTTP as non-secure.

chrome/browser/ui/toolbar/toolbar_model_impl.cc

Index: chrome/browser/ui/toolbar/toolbar_model_impl.cc
diff --git a/chrome/browser/ui/toolbar/toolbar_model_impl.cc b/chrome/browser/ui/toolbar/toolbar_model_impl.cc
index 8f2edcd0c7b07c1d13c637eff1042f1a1c57b671..eb5a2f6672cb3e8c14bac927ef54860fd2dccbf6 100644
--- a/chrome/browser/ui/toolbar/toolbar_model_impl.cc
+++ b/chrome/browser/ui/toolbar/toolbar_model_impl.cc
@@ -65,6 +65,27 @@ bool GetSecurityLevelForFieldTrialGroup(const std::string& group,
   return true;
 }
 
+ToolbarModel::SecurityLevel GetSecurityLevelForHttpFieldTrial() {
+  std::string choice = base::CommandLine::ForCurrentProcess()->
+      GetSwitchValueASCII(switches::kMarkHttpAsNonSecure);
+  if (choice == "no")

[felt, 2015/01/08 00:46:56]

nit: I'd recommend making these values constants. That's the normal pattern for
field trial strings. It also ensures that you use the same ones for the command
line and field trial, since you're using a single constant variable twice
instead of repeating the string twice in this method.

[palmer, 2015/01/16 23:42:41]

Done.

+    return ToolbarModel::NONE;
+  else if (choice == "dubious")
+    return ToolbarModel::SECURITY_WARNING;
+  else if (choice == "non-secure")
+    return ToolbarModel::SECURITY_ERROR;
+
+  std::string group = base::FieldTrialList::FindFullName("MarkHTTPAsNonSecure");
+  if (group == "no")
+    return ToolbarModel::NONE;
+  else if (group == "dubious")
+    return ToolbarModel::SECURITY_WARNING;
+  else if (group == "non-secure")
+    return ToolbarModel::SECURITY_ERROR;
+
+  return ToolbarModel::NONE;
+}
+
 }  // namespace
 
 ToolbarModelImpl::ToolbarModelImpl(ToolbarModelDelegate* delegate)
@@ -87,9 +108,15 @@ ToolbarModel::SecurityLevel ToolbarModelImpl::GetSecurityLevelForWebContents(
   const SSLStatus& ssl = entry->GetSSL();
   switch (ssl.security_style) {
     case content::SECURITY_STYLE_UNKNOWN:
-    case content::SECURITY_STYLE_UNAUTHENTICATED:
       return NONE;
 
+    case content::SECURITY_STYLE_UNAUTHENTICATED: {
+      const GURL& url = entry->GetURL();
+      if (url.SchemeIs("http") || url.SchemeIs("ftp"))

[Ryan Sleevi, 2015/01/12 21:03:52]

This (marking FTP here) is _not_ what I'd expect from the rest of this CL, from
your variables, from the command-line, or from the field trial.

Either remove this or let's work on better naming for all the *Http* stuff.

[palmer, 2015/01/16 23:42:41]

I'd prefer the latter — it would be confusing for the 2 people who have ever
seen ftp:// URLs.

I'll rename *Http* as kMarkNonSecureAs*, et c.

+        return GetSecurityLevelForHttpFieldTrial();
+      return NONE;
+    }
+
     case content::SECURITY_STYLE_AUTHENTICATION_BROKEN:
       return SECURITY_ERROR;