Skip interstitials and don't block requests for localhost SSL errors

chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc

Index: chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc
diff --git a/chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc b/chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc
index 35c84fab198e18b600570aa6a769c96ffbeb6786..e3dfb0ad0247e75bb249448aa8fafd9d336b5944 100644
--- a/chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc
+++ b/chrome/browser/ssl/chrome_ssl_host_state_delegate_test.cc
@@ -20,6 +20,7 @@
 #include "chrome/test/base/in_process_browser_test.h"
 #include "content/public/browser/ssl_host_state_delegate.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "net/base/test_data_directory.h"
 #include "net/test/cert_test_util.h"
@@ -27,7 +28,7 @@
 
 namespace {
 
-const char kGoogleCertFile[] = "google.single.der";
+const char kOkCertFile[] = "ok_cert.pem";
 
 const char kWWWGoogleHost[] = "www.google.com";
 const char kGoogleHost[] = "google.com";
@@ -38,8 +39,8 @@ const char kForgetInstantly[] = "0";
 const char kDeltaSecondsString[] = "86400";
 const uint64_t kDeltaOneDayInSeconds = UINT64_C(86400);
 
-scoped_refptr<net::X509Certificate> GetGoogleCert() {
-  return net::ImportCertFromFile(net::GetTestCertsDirectory(), kGoogleCertFile);
+scoped_refptr<net::X509Certificate> GetOkCert() {
+  return net::ImportCertFromFile(net::GetTestCertsDirectory(), kOkCertFile);

[Ryan Sleevi, 2015/02/09 19:31:34]

note: More for future reference, as this is OK here, but you may get reviews
(*cough* I'm guilty of it especially) being like "Oh hey, there's this other
thing in the code, you should fix it too"

In general, you should do that in a separate CL. Depending on whether the
reviewer flagged it as a "blocks this CL" or "nice follow-up cleanup" depends on
which order it is.

You can use git to have multiple reviews in progress (although sometimes it can
get a little tricky with the rebase-y stuff), just one CL per branch

So let's say I was a jerk and said "Fixing this blocks your localhost CL", and
your original setup was

  master -> localhostBranch
Fix it all up in a solo commit, so now you have
  master -> localhostBranch -> [extra commit to cleanup]
`git rebase -i` to reorder
  master -> [extra commit to cleanup] -> localhostBranch
`git checkout -b sleeviIsAJerk [extra commit hash]`
`git cl upload`
`git checkout localhostBranch`
`git branch --set-upstream-to sleeviIsAJerk localhostBranch`
`git cl upload` <-- will now diff sleeviIsAJerk...localhostBranch when uploading

If you didn't set the upstream (since I always botch that command), you can also
do
`git cl upload sleeviIsAJerk` to do the appropriate inter-branch diff, you just
have to remember it when uploading.


I just mention all of it because it was my #1 switching to Chromium-git (when we
still had Chromium-svn), and it's fairly common to find nits in existing code
and be asked "While you're here, can you clean up
[slightly-related-but-unrelated thing]"

That was the context for my ok_cert.pem grump.

But for this CL, it's small enough that I can deal :)

[estark, 2015/02/09 20:48:40]

makes sense, will do next time!

 }
 
 }  // namespace
@@ -56,9 +57,9 @@ class ChromeSSLHostStateDelegateTest : public InProcessBrowserTest {};
 // QueryPolicy unit tests the expected behavior of calling QueryPolicy on the
 // SSLHostStateDelegate class after various SSL cert decisions have been made.
 IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicy) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
-      browser()->tab_strip_model()->GetActiveWebContents();
+    browser()->tab_strip_model()->GetActiveWebContents();

[Ryan Sleevi, 2015/02/09 19:31:34]

STYLE: This should be four spaces.

You can run 'git cl format' and it should reformat per style guide.

[estark, 2015/02/09 20:48:40]

Done. That's very handy!

   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
   content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
   bool unused_value;
@@ -67,63 +68,63 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicy) {
   // before any action has been taken.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),

[Ryan Sleevi, 2015/02/09 19:31:34]

Is it necessary to call .get() on this, given that |cert| is a scoped_refptr?

I would expect that operator* from scoped_refptr "Just Works", hence "*cert"
should Just Work.

[estark, 2015/02/09 20:48:40]

Looks like *cert does work. I'll submit that it in a separate CL, now that I
know how to do that. :)

                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kExampleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 
   // Simulate a user decision to allow an invalid certificate exception for
   // kWWWGoogleHost.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
 
   // Verify that only kWWWGoogleHost is allowed and that the other two certs
   // being tested still are denied.
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kExampleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 
   // Simulate a user decision to allow an invalid certificate exception for
   // kExampleHost.
   state->AllowCert(
-      kExampleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kExampleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
 
   // Verify that both kWWWGoogleHost and kExampleHost have allow exceptions
   // while kGoogleHost still is denied.
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kExampleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
@@ -132,7 +133,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicy) {
 // HasAllowException before and after calling RevokeUserAllowExceptions on the
 // SSLHostStateDelegate class.
 IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, HasPolicyAndRevoke) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -143,9 +144,9 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, HasPolicyAndRevoke) {
   // Simulate a user decision to allow an invalid certificate exception for
   // kWWWGoogleHost and for kExampleHost.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   state->AllowCert(
-      kExampleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kExampleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
 
   // Verify that HasAllowException correctly acknowledges that a user decision
   // has been made about kWWWGoogleHost. Then verify that HasAllowException
@@ -155,7 +156,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, HasPolicyAndRevoke) {
   EXPECT_FALSE(state->HasAllowException(kWWWGoogleHost));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 
@@ -174,7 +175,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, HasPolicyAndRevoke) {
 // Clear unit tests the expected behavior of calling Clear to forget all cert
 // decision state on the SSLHostStateDelegate class.
 IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, Clear) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -185,7 +186,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, Clear) {
   // Simulate a user decision to allow an invalid certificate exception for
   // kWWWGoogleHost and for kExampleHost.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
 
   // Do a full clear, then make sure that both kWWWGoogleHost, which had a
   // decision made, and kExampleHost, which was untouched, are now in a denied
@@ -194,13 +195,13 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, Clear) {
   EXPECT_FALSE(state->HasAllowException(kWWWGoogleHost));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
   EXPECT_FALSE(state->HasAllowException(kExampleHost));
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kExampleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
@@ -235,7 +236,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest,
 // QueryPolicyExpired unit tests to make sure that if a certificate decision has
 // expired, the return value from QueryPolicy returns the correct vaule.
 IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, PRE_QueryPolicyExpired) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -246,7 +247,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, PRE_QueryPolicyExpired) {
   // should also indicate that it hasn't expired.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -254,10 +255,10 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, PRE_QueryPolicyExpired) {
   // After allowing the certificate, a query should say that it is allowed and
   // also specify that it hasn't expired.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -267,7 +268,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, PRE_QueryPolicyExpired) {
 // decisions after restart, the test needs to  wait until after a restart to
 // verify that the expiration state is correct.
 IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicyExpired) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -279,7 +280,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicyExpired) {
   // that they expired since the last query.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_TRUE(expired_previous_decision);
@@ -288,7 +289,7 @@ IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest, QueryPolicyExpired) {
   // occurred.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -306,7 +307,7 @@ class IncognitoSSLHostStateDelegateTest
 };
 
 IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, PRE_AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -316,7 +317,7 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, PRE_AfterRestart) {
   // Add a cert exception to the profile and then verify that it still exists
   // in the incognito profile.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
 
   scoped_ptr<Profile> incognito(profile->CreateOffTheRecordProfile());
   content::SSLHostStateDelegate* incognito_state =
@@ -324,7 +325,7 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, PRE_AfterRestart) {
 
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             incognito_state->QueryPolicy(kWWWGoogleHost,
-                                         *google_cert.get(),
+                                         *cert.get(),
                                          net::CERT_STATUS_DATE_INVALID,
                                          &unused_value));
 
@@ -333,11 +334,11 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, PRE_AfterRestart) {
   // error than above thus mapping to a second exception. Also validate that it
   // was not added as an exception to the regular profile.
   incognito_state->AllowCert(
-      kGoogleHost, *google_cert.get(), net::CERT_STATUS_COMMON_NAME_INVALID);
+      kGoogleHost, *cert.get(), net::CERT_STATUS_COMMON_NAME_INVALID);
 
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_COMMON_NAME_INVALID,
                                &unused_value));
 }
@@ -346,7 +347,7 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, PRE_AfterRestart) {
 // forgetten after a session restart even if given a command line flag to
 // remember cert decisions after restart.
 IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -358,7 +359,7 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, AfterRestart) {
   // incognito session ended.
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 
@@ -370,7 +371,7 @@ IN_PROC_BROWSER_TEST_F(IncognitoSSLHostStateDelegateTest, AfterRestart) {
   // cleared when the incognito session ended.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             incognito_state->QueryPolicy(kGoogleHost,
-                                         *google_cert.get(),
+                                         *cert.get(),
                                          net::CERT_STATUS_COMMON_NAME_INVALID,
                                          &unused_value));
 }
@@ -387,7 +388,7 @@ class ForGetSSLHostStateDelegateTest : public ChromeSSLHostStateDelegateTest {
 };
 
 IN_PROC_BROWSER_TEST_F(ForGetSSLHostStateDelegateTest, PRE_AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -395,16 +396,16 @@ IN_PROC_BROWSER_TEST_F(ForGetSSLHostStateDelegateTest, PRE_AfterRestart) {
   bool unused_value;
 
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
 
 IN_PROC_BROWSER_TEST_F(ForGetSSLHostStateDelegateTest, AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -415,7 +416,7 @@ IN_PROC_BROWSER_TEST_F(ForGetSSLHostStateDelegateTest, AfterRestart) {
   // exceptions after session end.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
@@ -434,7 +435,7 @@ class ForgetInstantlySSLHostStateDelegateTest
 
 IN_PROC_BROWSER_TEST_F(ForgetInstantlySSLHostStateDelegateTest,
                        MakeAndForgetException) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -452,10 +453,10 @@ IN_PROC_BROWSER_TEST_F(ForgetInstantlySSLHostStateDelegateTest,
   clock->SetNow(base::Time::NowFromSystemTime());
 
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
@@ -473,7 +474,7 @@ class RememberSSLHostStateDelegateTest : public ChromeSSLHostStateDelegateTest {
 };
 
 IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, PRE_AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -481,16 +482,16 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, PRE_AfterRestart) {
   bool unused_value;
 
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
 
 IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, AfterRestart) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -510,7 +511,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, AfterRestart) {
   // and thus has now been rememebered across browser restarts.
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 
@@ -520,7 +521,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, AfterRestart) {
   // The cert should now be |DENIED| because the specified delta has passed.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
@@ -530,7 +531,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, AfterRestart) {
 // unit tests to make sure that if a certificate decision has expired, the
 // return value from QueryPolicy returns the correct vaule.
 IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, QueryPolicyExpired) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -551,7 +552,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, QueryPolicyExpired) {
   // should also indicate that it hasn't expired.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -559,10 +560,10 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, QueryPolicyExpired) {
   // After allowing the certificate, a query should say that it is allowed and
   // also specify that it hasn't expired.
   state->AllowCert(
-      kWWWGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kWWWGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -575,7 +576,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, QueryPolicyExpired) {
   // query.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_TRUE(expired_previous_decision);
@@ -584,7 +585,7 @@ IN_PROC_BROWSER_TEST_F(RememberSSLHostStateDelegateTest, QueryPolicyExpired) {
   // occurred.
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kWWWGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &expired_previous_decision));
   EXPECT_FALSE(expired_previous_decision);
@@ -607,7 +608,7 @@ class RemoveBrowsingHistorySSLHostStateDelegateTest
 
 IN_PROC_BROWSER_TEST_F(RemoveBrowsingHistorySSLHostStateDelegateTest,
                        DeleteHistory) {
-  scoped_refptr<net::X509Certificate> google_cert = GetGoogleCert();
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
@@ -617,11 +618,74 @@ IN_PROC_BROWSER_TEST_F(RemoveBrowsingHistorySSLHostStateDelegateTest,
   // Add an exception for an invalid certificate. Then remove the last hour's
   // worth of browsing history and verify that the exception has been deleted.
   state->AllowCert(
-      kGoogleHost, *google_cert.get(), net::CERT_STATUS_DATE_INVALID);
+      kGoogleHost, *cert.get(), net::CERT_STATUS_DATE_INVALID);
   RemoveAndWait(profile);
   EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
             state->QueryPolicy(kGoogleHost,
-                               *google_cert.get(),
+                               *cert.get(),
                                net::CERT_STATUS_DATE_INVALID,
                                &unused_value));
 }
+
+// Tests to make sure that localhost certificate errors are ignored or

[jww, 2015/02/09 19:29:38]

This is really nit picky, but you might want to reverse "...are ignored..." and
"...treated as normal errors..." since the actual tests are in the reverse order
(this confused me when I read your comment).

[estark, 2015/02/09 20:48:40]

Done. (I don't think it's that nit-picky, FWIW :) )

+// treated as normal errors, depending on whether the
+// kAllowInsecureLocalhost flag is set.
+
+// When the flag isn't set, requests to localhost with invalid
+// certificates should be denied.
+IN_PROC_BROWSER_TEST_F(ChromeSSLHostStateDelegateTest,
+                       LocalhostErrorWithoutFlag) {
+  // Serve the Google cert for localhost to generate an error.
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
+  content::WebContents* tab =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
+  content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
+  bool unused_value;
+
+  EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
+            state->QueryPolicy("localhost",
+                               *cert.get(),
+                               net::CERT_STATUS_COMMON_NAME_INVALID,
+                               &unused_value));
+
+  EXPECT_EQ(content::SSLHostStateDelegate::DENIED,
+            state->QueryPolicy("127.0.0.1",
+                               *cert.get(),
+                               net::CERT_STATUS_COMMON_NAME_INVALID,
+                               &unused_value));
+}
+
+// When the flag is set, requests to localhost with invalid certificates
+// should be allowed.
+class AllowLocalhostErrorsSSLHostStateDelegateTest
+    : public ChromeSSLHostStateDelegateTest {
+ protected:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ChromeSSLHostStateDelegateTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch(switches::kAllowInsecureLocalhost);
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(AllowLocalhostErrorsSSLHostStateDelegateTest,
+                       LocalhostErrorWithFlag) {
+  // Serve the Google cert for localhost to generate an error.
+  scoped_refptr<net::X509Certificate> cert = GetOkCert();
+  content::WebContents* tab =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  Profile* profile = Profile::FromBrowserContext(tab->GetBrowserContext());
+  content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
+  bool unused_value;
+
+  EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
+            state->QueryPolicy("localhost",
+                               *cert.get(),
+                               net::CERT_STATUS_COMMON_NAME_INVALID,
+                               &unused_value));
+
+  EXPECT_EQ(content::SSLHostStateDelegate::ALLOWED,
+            state->QueryPolicy("127.0.0.1",
+                               *cert.get(),
+                               net::CERT_STATUS_COMMON_NAME_INVALID,
+                               &unused_value));
+}