Skip interstitials and don't block requests for localhost SSL errors

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 
 #include "base/auto_reset.h"
@@ skipping 89 matching lines @@
 #include "media/base/audio_renderer_mixer_input.h"
 #include "media/base/media_log.h"
 #include "media/blink/webcontentdecryptionmodule_impl.h"
 #include "media/blink/webencryptedmediaclient_impl.h"
 #include "media/blink/webmediaplayer_impl.h"
 #include "media/blink/webmediaplayer_params.h"
 #include "media/filters/gpu_video_accelerator_factories.h"
 #include "net/base/data_url.h"
 #include "net/base/net_errors.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
+#include "net/cert/cert_status_flags.h"
 #include "net/http/http_util.h"
 #include "third_party/WebKit/public/platform/WebStorageQuotaCallbacks.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/platform/WebURLError.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
 #include "third_party/WebKit/public/web/WebColorSuggestion.h"
+#include "third_party/WebKit/public/web/WebConsoleMessage.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrameWidget.h"
 #include "third_party/WebKit/public/web/WebGlyphCache.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebMediaStreamRegistry.h"
 #include "third_party/WebKit/public/web/WebNavigationPolicy.h"
 #include "third_party/WebKit/public/web/WebPlugin.h"
 #include "third_party/WebKit/public/web/WebPluginParams.h"
 #include "third_party/WebKit/public/web/WebPluginPlaceholder.h"
 #include "third_party/WebKit/public/web/WebRange.h"
@@ skipping 2607 matching lines @@
       TRACE_EVENT_INSTANT0("WebCore", "LoadFinished",
                            TRACE_EVENT_SCOPE_PROCESS);
     }
     document_state->set_finish_load_time(Time::Now());
   }
 
   FOR_EACH_OBSERVER(RenderViewObserver, render_view_->observers(),
                     DidFinishLoad(frame));
   FOR_EACH_OBSERVER(RenderFrameObserver, observers_, DidFinishLoad());
 
+  // If the navigation is to a localhost URL, print a warning to the
+  // console telling the developer to check their SSL configuration
+  // before going to production.
+  //
+  // TODO(estark): do we want to print this only if the
+  // kAllowInsecureLocalhost flag is set?

[Ryan Sleevi, 2015/02/04 19:34:42]

That's my gut feeling too.

Note, our use of TODO at Google is a little... weirdish.
http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#TODO_Comments

[estark, 2015/02/05 03:02:38]

Done.

+  SSLStatus ssl_status = render_view_->GetSSLStatusOfFrame(frame_);
+  if (net::IsCertStatusError(ssl_status.cert_status) &&
+      GURL(ds->request().url()).DomainIs("localhost")) {
+    frame_->addMessageToConsole(
+        blink::WebConsoleMessage(
+            blink::WebConsoleMessage::LevelWarning,
+            base::ASCIIToUTF16("This site does not have a valid SSL "
+                               "certificate! Without SSL, your site's and "
+                               "visitors' data is vulnerable to theft and "
+                               "tampering. Get a valid SSL certificate before "
+                               "releasing your website to the public.")));
+  }
+
   // Don't send this message while the frame is swapped out.
   if (is_swapped_out())
     return;
 
   Send(new FrameHostMsg_DidFinishLoad(routing_id_,
                                       ds->request().url()));
 }
 
 void RenderFrameImpl::didNavigateWithinPage(blink::WebLocalFrame* frame,
     const blink::WebHistoryItem& item,
@@ skipping 1722 matching lines @@
 
 #if defined(ENABLE_BROWSER_CDMS)
 RendererCdmManager* RenderFrameImpl::GetCdmManager() {
   if (!cdm_manager_)
     cdm_manager_ = new RendererCdmManager(this);
   return cdm_manager_;
 }
 #endif  // defined(ENABLE_BROWSER_CDMS)
 
 }  // namespace content