Skip interstitials and don't block requests for localhost SSL errors

chrome/browser/ssl/chrome_ssl_host_state_delegate.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate.h"
 
 #include <set>
 
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/metrics/field_trial.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/time/clock.h"
 #include "base/time/default_clock.h"
 #include "base/time/time.h"
 #include "base/values.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/content_settings/core/common/content_settings_types.h"
 #include "components/variations/variations_associated_data.h"
+#include "content/public/common/content_switches.h"
 #include "net/base/hash_value.h"
+#include "net/base/net_util.h"
 #include "net/cert/x509_certificate.h"
 #include "net/http/http_transaction_factory.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "url/gurl.h"
 
 namespace {
 
 // Switch value that specifies that certificate decisions should be forgotten at
 // the end of the current session.
@@ skipping 284 matching lines @@
 content::SSLHostStateDelegate::CertJudgment
 ChromeSSLHostStateDelegate::QueryPolicy(const std::string& host,
                                         const net::X509Certificate& cert,
                                         net::CertStatus error,
                                         bool* expired_previous_decision) {
   HostContentSettingsMap* map = profile_->GetHostContentSettingsMap();
   GURL url = GetSecureGURLForHost(host);
   scoped_ptr<base::Value> value(map->GetWebsiteSetting(
       url, url, CONTENT_SETTINGS_TYPE_SSL_CERT_DECISIONS, std::string(), NULL));
 
+  // If the appropriate flag is set, let requests on localhost go
+  // through even if there are certificate errors. Errors on localhost
+  // are unlikely to indicate actual security problems.
+  bool allow_localhost = base::CommandLine::ForCurrentProcess()->

[jww, 2015/02/09 19:29:38]

The "*expired_previous_decision = false;" line should go before this code,
otherwise the caller will have a mystery return value.

[estark, 2015/02/09 20:48:40]

Done.

+    HasSwitch(switches::kAllowInsecureLocalhost);
+  if (allow_localhost && net::IsLocalhost(url.host())) {
+    return ALLOWED;
+  }

[Ryan Sleevi, 2015/02/09 19:31:34]

Note: Consistent with the style in the rest of this file, you would omit the {}
for the single-line if.

( http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Conditionals
lists them as optional, so defer to local code patterns)

[estark, 2015/02/09 20:48:40]

Done.

+
   // Set a default value in case this method is short circuited and doesn't do a
   // full query.
   *expired_previous_decision = false;
   if (!value.get() || !value->IsType(base::Value::TYPE_DICTIONARY))
     return DENIED;
 
   base::DictionaryValue* dict;  // Owned by value
   int policy_decision;
   bool success = value->GetAsDictionary(&dict);
   DCHECK(success);
@@ skipping 91 matching lines @@
 }
 
 bool ChromeSSLHostStateDelegate::DidHostRunInsecureContent(
     const std::string& host,
     int pid) const {
   return !!ran_insecure_content_hosts_.count(BrokenHostEntry(host, pid));
 }
 void ChromeSSLHostStateDelegate::SetClock(scoped_ptr<base::Clock> clock) {
   clock_.reset(clock.release());
 }