chrome/browser/ui/website_settings/website_settings.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ui/website_settings/website_settings.h"
   6
   7 #include <string>
   8 #include <vector>
   9
  10 #include "base/command_line.h"
  11 #include "base/i18n/time_formatting.h"
  12 #include "base/metrics/field_trial.h"
  13 #include "base/metrics/histogram.h"
  14 #include "base/strings/string_number_conversions.h"
  15 #include "base/strings/stringprintf.h"
  16 #include "base/strings/utf_string_conversions.h"
  17 #include "base/values.h"
  18 #include "chrome/browser/browser_process.h"
  19 #include "chrome/browser/browsing_data/browsing_data_channel_id_helper.h"
  20 #include "chrome/browser/browsing_data/browsing_data_cookie_helper.h"
  21 #include "chrome/browser/browsing_data/browsing_data_database_helper.h"
  22 #include "chrome/browser/browsing_data/browsing_data_file_system_helper.h"
  23 #include "chrome/browser/browsing_data/browsing_data_indexed_db_helper.h"
  24 #include "chrome/browser/browsing_data/browsing_data_local_storage_helper.h"
  25 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
  26 #include "chrome/browser/history/history_service_factory.h"
  27 #include "chrome/browser/infobars/infobar_service.h"
  28 #include "chrome/browser/profiles/profile.h"
  29 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate.h"
  30 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate_factory.h"
  31 #include "chrome/browser/ui/website_settings/website_settings_ui.h"
  32 #include "chrome/common/chrome_switches.h"
  33 #include "chrome/common/pref_names.h"
  34 #include "chrome/common/url_constants.h"
  35 #include "chrome/grit/chromium_strings.h"
  36 #include "chrome/grit/generated_resources.h"
  37 #include "components/content_settings/core/browser/content_settings_utils.h"
  38 #include "components/content_settings/core/browser/host_content_settings_map.h"
  39 #include "components/content_settings/core/browser/local_shared_objects_counter.h"
  40 #include "components/content_settings/core/common/content_settings.h"
  41 #include "components/content_settings/core/common/content_settings_pattern.h"
  42 #include "components/rappor/rappor_utils.h"
  43 #include "components/ssl_errors/error_info.h"
  44 #include "components/url_formatter/elide_url.h"
  45 #include "content/public/browser/browser_thread.h"
  46 #include "content/public/browser/cert_store.h"
  47 #include "content/public/browser/user_metrics.h"
  48 #include "content/public/common/content_switches.h"
  49 #include "content/public/common/url_constants.h"
  50 #include "net/cert/cert_status_flags.h"
  51 #include "net/cert/x509_certificate.h"
  52 #include "net/ssl/ssl_cipher_suite_names.h"
  53 #include "net/ssl/ssl_connection_status_flags.h"
  54 #include "ui/base/l10n/l10n_util.h"
  55
  56 #if defined(OS_CHROMEOS)
  57 #include "chrome/browser/chromeos/policy/policy_cert_service.h"
  58 #include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
  59 #endif
  60
  61 #if !defined(OS_ANDROID)
  62 #include "chrome/browser/ui/website_settings/website_settings_infobar_delegate.h"
  63 #endif
  64
  65 using base::ASCIIToUTF16;
  66 using base::UTF8ToUTF16;
  67 using base::UTF16ToUTF8;
  68 using content::BrowserThread;
  69
  70 namespace {
  71
  72 // Events for UMA. Do not reorder or change!
  73 enum SSLCertificateDecisionsDidRevoke {
  74   USER_CERT_DECISIONS_NOT_REVOKED = 0,
  75   USER_CERT_DECISIONS_REVOKED,
  76   END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM
  77 };
  78
  79 // The list of content settings types to display on the Website Settings UI. THE
  80 // ORDER OF THESE ITEMS IS IMPORTANT. To propose changing it, email
  81 // security-dev@chromium.org.
  82 ContentSettingsType kPermissionType[] = {
  83     CONTENT_SETTINGS_TYPE_GEOLOCATION,
  84     CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
  85     CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC,
  86     CONTENT_SETTINGS_TYPE_NOTIFICATIONS,
  87     CONTENT_SETTINGS_TYPE_IMAGES,
  88     CONTENT_SETTINGS_TYPE_JAVASCRIPT,
  89     CONTENT_SETTINGS_TYPE_POPUPS,
  90     CONTENT_SETTINGS_TYPE_FULLSCREEN,
  91     CONTENT_SETTINGS_TYPE_AUTOMATIC_DOWNLOADS,
  92     CONTENT_SETTINGS_TYPE_PLUGINS,
  93     CONTENT_SETTINGS_TYPE_MOUSELOCK,
  94     CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
  95 #if defined(OS_ANDROID)
  96     CONTENT_SETTINGS_TYPE_PUSH_MESSAGING,
  97 #endif
  98 };
  99
 100 bool CertificateTransparencyStatusMatch(
 101     const std::vector<net::ct::SCTVerifyStatus>& sct_verify_statuses,
 102     net::ct::SCTVerifyStatus status) {
 103   for (const auto& verify_status : sct_verify_statuses) {
 104     if (verify_status == status)
 105       return true;
 106   }
 107   return false;
 108 }
 109
 110 int GetSiteIdentityDetailsMessageByCTInfo(
 111     const std::vector<net::ct::SCTVerifyStatus>& sct_verify_statuses,
 112     bool is_ev) {
 113   // No SCTs - no CT information.
 114   if (sct_verify_statuses.empty())
 115     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_NO_CT
 116                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_NO_CT);
 117
 118   if (CertificateTransparencyStatusMatch(sct_verify_statuses,
 119                                          net::ct::SCT_STATUS_OK))
 120     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_VERIFIED
 121                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_VERIFIED);
 122
 123   if (CertificateTransparencyStatusMatch(sct_verify_statuses,
 124                                          net::ct::SCT_STATUS_INVALID))
 125     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_INVALID
 126                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_INVALID);
 127
 128   // status is SCT_STATUS_LOG_UNKNOWN
 129   return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_UNVERIFIED
 130                 : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_UNVERIFIED);
 131 }
 132
 133 // This function will return SITE_IDENTITY_STATUS_CERT or
 134 // SITE_IDENTITY_STATUS_EV_CERT depending on |is_ev| unless there are SCTs
 135 // which failed verification, in which case it will return
 136 // SITE_IDENTITY_STATUS_ERROR.
 137 WebsiteSettings::SiteIdentityStatus GetSiteIdentityStatusByCTInfo(
 138     const std::vector<net::ct::SCTVerifyStatus>& sct_verify_statuses,
 139     bool is_ev) {
 140   if (CertificateTransparencyStatusMatch(sct_verify_statuses,
 141                                          net::ct::SCT_STATUS_INVALID))
 142     return WebsiteSettings::SITE_IDENTITY_STATUS_ERROR;
 143
 144   return is_ev ? WebsiteSettings::SITE_IDENTITY_STATUS_EV_CERT
 145                : WebsiteSettings::SITE_IDENTITY_STATUS_CERT;
 146 }
 147
 148 base::string16 GetSimpleSiteName(const GURL& url, Profile* profile) {
 149   std::string languages;
 150   if (profile)
 151     languages = profile->GetPrefs()->GetString(prefs::kAcceptLanguages);
 152   return url_formatter::FormatUrlForSecurityDisplayOmitScheme(url, languages);
 153 }
 154
 155 }  // namespace
 156
 157 WebsiteSettings::WebsiteSettings(
 158     WebsiteSettingsUI* ui,
 159     Profile* profile,
 160     TabSpecificContentSettings* tab_specific_content_settings,
 161     content::WebContents* web_contents,
 162     const GURL& url,
 163     const SecurityStateModel::SecurityInfo& security_info,
 164     content::CertStore* cert_store)
 165     : TabSpecificContentSettings::SiteDataObserver(
 166           tab_specific_content_settings),
 167       ui_(ui),
 168       web_contents_(web_contents),
 169       show_info_bar_(false),
 170       site_url_(url),
 171       site_identity_status_(SITE_IDENTITY_STATUS_UNKNOWN),
 172       cert_id_(0),
 173       site_connection_status_(SITE_CONNECTION_STATUS_UNKNOWN),
 174       cert_store_(cert_store),
 175       content_settings_(HostContentSettingsMapFactory::GetForProfile(profile)),
 176       chrome_ssl_host_state_delegate_(
 177           ChromeSSLHostStateDelegateFactory::GetForProfile(profile)),
 178       did_revoke_user_ssl_decisions_(false),
 179       profile_(profile) {
 180   Init(url, security_info);
 181
 182   PresentSitePermissions();
 183   PresentSiteData();
 184   PresentSiteIdentity();
 185
 186   // Every time the Website Settings UI is opened a |WebsiteSettings| object is
 187   // created. So this counts how ofter the Website Settings UI is opened.
 188   RecordWebsiteSettingsAction(WEBSITE_SETTINGS_OPENED);
 189 }
 190
 191 WebsiteSettings::~WebsiteSettings() {
 192 }
 193
 194 void WebsiteSettings::RecordWebsiteSettingsAction(
 195     WebsiteSettingsAction action) {
 196   UMA_HISTOGRAM_ENUMERATION("WebsiteSettings.Action",
 197                             action,
 198                             WEBSITE_SETTINGS_COUNT);
 199
 200   // Use a separate histogram to record actions if they are done on a page with
 201   // an HTTPS URL. Note that this *disregards* security status.
 202   //
 203
 204   // TODO(palmer): Consider adding a new histogram for
 205   // GURL::SchemeIsCryptographic. (We don't want to replace this call with a
 206   // call to that function because we don't want to change the meanings of
 207   // existing metrics.) This would inform the decision to mark non-secure
 208   // origins as Dubious or Non-Secure; the overall bug for that is
 209   // crbug.com/454579.
 210   if (site_url_.SchemeIs(url::kHttpsScheme)) {
 211     UMA_HISTOGRAM_ENUMERATION("WebsiteSettings.Action.HttpsUrl",
 212                               action,
 213                               WEBSITE_SETTINGS_COUNT);
 214   }
 215 }
 216
 217 // Get corresponding Rappor Metric.
 218 const std::string GetRapporMetric(ContentSettingsType permission) {
 219   std::string permission_str;
 220   switch (permission) {
 221     case CONTENT_SETTINGS_TYPE_GEOLOCATION:
 222       permission_str = "Geolocation";
 223       break;
 224     case CONTENT_SETTINGS_TYPE_NOTIFICATIONS:
 225       permission_str = "Notifications";
 226       break;
 227     case CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC:
 228       permission_str = "Mic";
 229       break;
 230     case CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA:
 231       permission_str = "Camera";
 232       break;
 233     default:
 234       return "";
 235   }
 236
 237   return base::StringPrintf("ContentSettings.PermissionActions_%s.Revoked.Url",
 238                             permission_str.c_str());
 239 }
 240
 241 void WebsiteSettings::OnSitePermissionChanged(ContentSettingsType type,
 242                                               ContentSetting setting) {
 243   // Count how often a permission for a specific content type is changed using
 244   // the Website Settings UI.
 245   size_t num_values;
 246   int histogram_value = ContentSettingTypeToHistogramValue(type, &num_values);
 247   UMA_HISTOGRAM_ENUMERATION("WebsiteSettings.OriginInfo.PermissionChanged",
 248                             histogram_value, num_values);
 249
 250   if (setting == ContentSetting::CONTENT_SETTING_ALLOW) {
 251     UMA_HISTOGRAM_ENUMERATION(
 252         "WebsiteSettings.OriginInfo.PermissionChanged.Allowed", histogram_value,
 253         num_values);
 254   } else if (setting == ContentSetting::CONTENT_SETTING_BLOCK) {
 255     UMA_HISTOGRAM_ENUMERATION(
 256         "WebsiteSettings.OriginInfo.PermissionChanged.Blocked", histogram_value,
 257         num_values);
 258     // Trigger Rappor sampling if it is a permission revoke action.
 259     const std::string& rappor_metric = GetRapporMetric(type);
 260     if (!rappor_metric.empty()) {
 261       rappor::SampleDomainAndRegistryFromGURL(
 262           g_browser_process->rappor_service(), rappor_metric, this->site_url_);
 263     }
 264   }
 265
 266   // This is technically redundant given the histogram above, but putting the
 267   // total count of permission changes in another histogram makes it easier to
 268   // compare it against other kinds of actions in WebsiteSettings[PopupView].
 269   RecordWebsiteSettingsAction(WEBSITE_SETTINGS_CHANGED_PERMISSION);
 270
 271   ContentSettingsPattern primary_pattern;
 272   ContentSettingsPattern secondary_pattern;
 273   switch (type) {
 274     case CONTENT_SETTINGS_TYPE_GEOLOCATION:
 275     case CONTENT_SETTINGS_TYPE_MIDI_SYSEX:
 276     case CONTENT_SETTINGS_TYPE_FULLSCREEN:
 277       // TODO(markusheintz): The rule we create here should also change the
 278       // location permission for iframed content.
 279       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 280       secondary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 281       break;
 282     case CONTENT_SETTINGS_TYPE_NOTIFICATIONS:
 283       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 284       secondary_pattern = ContentSettingsPattern::Wildcard();
 285       break;
 286     case CONTENT_SETTINGS_TYPE_IMAGES:
 287     case CONTENT_SETTINGS_TYPE_JAVASCRIPT:
 288     case CONTENT_SETTINGS_TYPE_PLUGINS:
 289     case CONTENT_SETTINGS_TYPE_POPUPS:
 290     case CONTENT_SETTINGS_TYPE_MOUSELOCK:
 291     case CONTENT_SETTINGS_TYPE_AUTOMATIC_DOWNLOADS:
 292     case CONTENT_SETTINGS_TYPE_PUSH_MESSAGING:
 293       primary_pattern = ContentSettingsPattern::FromURL(site_url_);
 294       secondary_pattern = ContentSettingsPattern::Wildcard();
 295       break;
 296     case CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC:
 297     case CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA:
 298       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 299       secondary_pattern = ContentSettingsPattern::Wildcard();
 300       break;
 301     default:
 302       NOTREACHED() << "ContentSettingsType " << type << "is not supported.";
 303       break;
 304   }
 305
 306   // Permission settings are specified via rules. There exists always at least
 307   // one rule for the default setting. Get the rule that currently defines
 308   // the permission for the given permission |type|. Then test whether the
 309   // existing rule is more specific than the rule we are about to create. If
 310   // the existing rule is more specific, than change the existing rule instead
 311   // of creating a new rule that would be hidden behind the existing rule.
 312   content_settings::SettingInfo info;
 313   scoped_ptr<base::Value> v =
 314       content_settings_->GetWebsiteSetting(
 315           site_url_, site_url_, type, std::string(), &info);
 316   content_settings_->SetNarrowestWebsiteSetting(
 317       primary_pattern, secondary_pattern, type, std::string(), setting, info);
 318
 319   show_info_bar_ = true;
 320
 321   // Refresh the UI to reflect the new setting.
 322   PresentSitePermissions();
 323 }
 324
 325 void WebsiteSettings::OnSiteDataAccessed() {
 326   PresentSiteData();
 327 }
 328
 329 void WebsiteSettings::OnUIClosing() {
 330 #if defined(OS_ANDROID)
 331   NOTREACHED();
 332 #else
 333   if (show_info_bar_ && web_contents_) {
 334     InfoBarService* infobar_service =
 335         InfoBarService::FromWebContents(web_contents_);
 336     if (infobar_service)
 337       WebsiteSettingsInfoBarDelegate::Create(infobar_service);
 338   }
 339
 340   SSLCertificateDecisionsDidRevoke user_decision =
 341       did_revoke_user_ssl_decisions_ ? USER_CERT_DECISIONS_REVOKED
 342                                      : USER_CERT_DECISIONS_NOT_REVOKED;
 343
 344   UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.did_user_revoke_decisions",
 345                             user_decision,
 346                             END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM);
 347 #endif
 348 }
 349
 350 void WebsiteSettings::OnRevokeSSLErrorBypassButtonPressed() {
 351   DCHECK(chrome_ssl_host_state_delegate_);
 352   chrome_ssl_host_state_delegate_->RevokeUserAllowExceptionsHard(
 353       site_url().host());
 354   did_revoke_user_ssl_decisions_ = true;
 355 }
 356
 357 void WebsiteSettings::Init(
 358     const GURL& url,
 359     const SecurityStateModel::SecurityInfo& security_info) {
 360   bool isChromeUINativeScheme = false;
 361 #if defined(OS_ANDROID)
 362   isChromeUINativeScheme = url.SchemeIs(chrome::kChromeUINativeScheme);
 363 #endif
 364
 365   if (url.SchemeIs(content::kChromeUIScheme) ||
 366       url.SchemeIs(url::kAboutScheme) || isChromeUINativeScheme) {
 367     site_identity_status_ = SITE_IDENTITY_STATUS_INTERNAL_PAGE;
 368     site_identity_details_ =
 369         l10n_util::GetStringUTF16(IDS_PAGE_INFO_INTERNAL_PAGE);
 370     site_connection_status_ = SITE_CONNECTION_STATUS_INTERNAL_PAGE;
 371     return;
 372   }
 373
 374   // Identity section.
 375   scoped_refptr<net::X509Certificate> cert;
 376   cert_id_ = security_info.cert_id;
 377
 378   // HTTPS with no or minor errors.
 379   if (security_info.cert_id &&
 380       cert_store_->RetrieveCert(security_info.cert_id, &cert) &&
 381       (!net::IsCertStatusError(security_info.cert_status) ||
 382        net::IsCertStatusMinorError(security_info.cert_status))) {
 383     // There are no major errors. Check for minor errors.
 384     if (security_info.security_level ==
 385         SecurityStateModel::SECURITY_POLICY_WARNING) {
 386       site_identity_status_ = SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT;
 387       site_identity_details_ = l10n_util::GetStringFUTF16(
 388           IDS_CERT_POLICY_PROVIDED_CERT_MESSAGE, UTF8ToUTF16(url.host()));
 389     } else if (net::IsCertStatusMinorError(security_info.cert_status)) {
 390       site_identity_status_ = SITE_IDENTITY_STATUS_CERT_REVOCATION_UNKNOWN;
 391       base::string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
 392       if (issuer_name.empty()) {
 393         issuer_name.assign(l10n_util::GetStringUTF16(
 394             IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 395       }
 396
 397       site_identity_details_.assign(l10n_util::GetStringFUTF16(
 398           GetSiteIdentityDetailsMessageByCTInfo(
 399               security_info.sct_verify_statuses, false /* not EV */),
 400           issuer_name));
 401
 402       site_identity_details_ += ASCIIToUTF16("\n\n");
 403       if (security_info.cert_status &
 404           net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION) {
 405         site_identity_details_ += l10n_util::GetStringUTF16(
 406             IDS_PAGE_INFO_SECURITY_TAB_UNABLE_TO_CHECK_REVOCATION);
 407       } else if (security_info.cert_status &
 408                  net::CERT_STATUS_NO_REVOCATION_MECHANISM) {
 409         site_identity_details_ += l10n_util::GetStringUTF16(
 410             IDS_PAGE_INFO_SECURITY_TAB_NO_REVOCATION_MECHANISM);
 411       } else {
 412         NOTREACHED() << "Need to specify string for this warning";
 413       }
 414     } else {
 415       if (security_info.cert_status & net::CERT_STATUS_IS_EV) {
 416         // EV HTTPS page.
 417         site_identity_status_ = GetSiteIdentityStatusByCTInfo(
 418             security_info.sct_verify_statuses, true);
 419         DCHECK(!cert->subject().organization_names.empty());
 420         organization_name_ = UTF8ToUTF16(cert->subject().organization_names[0]);
 421         // An EV Cert is required to have a city (localityName) and country but
 422         // state is "if any".
 423         DCHECK(!cert->subject().locality_name.empty());
 424         DCHECK(!cert->subject().country_name.empty());
 425         base::string16 locality;
 426         if (!cert->subject().state_or_province_name.empty()) {
 427           locality = l10n_util::GetStringFUTF16(
 428               IDS_PAGEINFO_ADDRESS,
 429               UTF8ToUTF16(cert->subject().locality_name),
 430               UTF8ToUTF16(cert->subject().state_or_province_name),
 431               UTF8ToUTF16(cert->subject().country_name));
 432         } else {
 433           locality = l10n_util::GetStringFUTF16(
 434               IDS_PAGEINFO_PARTIAL_ADDRESS,
 435               UTF8ToUTF16(cert->subject().locality_name),
 436               UTF8ToUTF16(cert->subject().country_name));
 437         }
 438         DCHECK(!cert->subject().organization_names.empty());
 439         site_identity_details_.assign(l10n_util::GetStringFUTF16(
 440             GetSiteIdentityDetailsMessageByCTInfo(
 441                 security_info.sct_verify_statuses, true /* is EV */),
 442             UTF8ToUTF16(cert->subject().organization_names[0]), locality,
 443             UTF8ToUTF16(cert->issuer().GetDisplayName())));
 444       } else {
 445         // Non-EV OK HTTPS page.
 446         site_identity_status_ = GetSiteIdentityStatusByCTInfo(
 447             security_info.sct_verify_statuses, false);
 448         base::string16 issuer_name(
 449             UTF8ToUTF16(cert->issuer().GetDisplayName()));
 450         if (issuer_name.empty()) {
 451           issuer_name.assign(l10n_util::GetStringUTF16(
 452               IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 453         }
 454
 455         site_identity_details_.assign(l10n_util::GetStringFUTF16(
 456             GetSiteIdentityDetailsMessageByCTInfo(
 457                 security_info.sct_verify_statuses, false /* not EV */),
 458             issuer_name));
 459       }
 460       if (security_info.sha1_deprecation_status !=
 461           SecurityStateModel::NO_DEPRECATED_SHA1) {
 462         site_identity_status_ =
 463             SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM;
 464         site_identity_details_ +=
 465             UTF8ToUTF16("\n\n") +
 466             l10n_util::GetStringUTF16(
 467                 IDS_PAGE_INFO_SECURITY_TAB_DEPRECATED_SIGNATURE_ALGORITHM);
 468       }
 469     }
 470   } else {
 471     // HTTP or HTTPS with errors (not warnings).
 472     site_identity_details_.assign(l10n_util::GetStringUTF16(
 473         IDS_PAGE_INFO_SECURITY_TAB_INSECURE_IDENTITY));
 474     if (!security_info.scheme_is_cryptographic || !security_info.cert_id)
 475       site_identity_status_ = SITE_IDENTITY_STATUS_NO_CERT;
 476     else
 477       site_identity_status_ = SITE_IDENTITY_STATUS_ERROR;
 478
 479     const base::string16 bullet = UTF8ToUTF16("\n • ");
 480     std::vector<ssl_errors::ErrorInfo> errors;
 481     ssl_errors::ErrorInfo::GetErrorsForCertStatus(
 482         cert, security_info.cert_status, url, &errors);
 483     for (size_t i = 0; i < errors.size(); ++i) {
 484       site_identity_details_ += bullet;
 485       site_identity_details_ += errors[i].short_description();
 486     }
 487
 488     if (security_info.cert_status & net::CERT_STATUS_NON_UNIQUE_NAME) {
 489       site_identity_details_ += ASCIIToUTF16("\n\n");
 490       site_identity_details_ += l10n_util::GetStringUTF16(
 491           IDS_PAGE_INFO_SECURITY_TAB_NON_UNIQUE_NAME);
 492     }
 493   }
 494
 495   // Site Connection
 496   // We consider anything less than 80 bits encryption to be weak encryption.
 497   // TODO(wtc): Bug 1198735: report mixed/unsafe content for unencrypted and
 498   // weakly encrypted connections.
 499   site_connection_status_ = SITE_CONNECTION_STATUS_UNKNOWN;
 500
 501   base::string16 subject_name(GetSimpleSiteName(url, profile_));
 502   if (subject_name.empty()) {
 503     subject_name.assign(
 504         l10n_util::GetStringUTF16(IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 505   }
 506
 507   if (!security_info.cert_id || !security_info.scheme_is_cryptographic) {
 508     // Page is still loading (so SSL status is not yet available) or
 509     // loaded over HTTP or loaded over HTTPS with no cert.
 510     site_connection_status_ = SITE_CONNECTION_STATUS_UNENCRYPTED;
 511
 512     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 513         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
 514         subject_name));
 515   } else if (security_info.security_bits < 0) {
 516     // Security strength is unknown.  Say nothing.
 517     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 518   } else if (security_info.security_bits == 0) {
 519     DCHECK_NE(security_info.security_level, SecurityStateModel::NONE);
 520     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 521     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 522         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
 523         subject_name));
 524   } else {
 525     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED;
 526
 527     if (net::SSLConnectionStatusToVersion(security_info.connection_status) >=
 528             net::SSL_CONNECTION_VERSION_TLS1_2 &&
 529         net::IsSecureTLSCipherSuite(net::SSLConnectionStatusToCipherSuite(
 530             security_info.connection_status))) {
 531       site_connection_details_.assign(l10n_util::GetStringFUTF16(
 532           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_CONNECTION_TEXT,
 533           subject_name));
 534     } else {
 535       site_connection_details_.assign(l10n_util::GetStringFUTF16(
 536           IDS_PAGE_INFO_SECURITY_TAB_WEAK_ENCRYPTION_CONNECTION_TEXT,
 537           subject_name));
 538     }
 539
 540     if (security_info.mixed_content_status !=
 541         SecurityStateModel::NO_MIXED_CONTENT) {
 542       bool ran_insecure_content =
 543           (security_info.mixed_content_status ==
 544                SecurityStateModel::RAN_MIXED_CONTENT ||
 545            security_info.mixed_content_status ==
 546                SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT);
 547       site_connection_status_ = ran_insecure_content
 548                                     ? SITE_CONNECTION_STATUS_MIXED_SCRIPT
 549                                     : SITE_CONNECTION_STATUS_MIXED_CONTENT;
 550       site_connection_details_.assign(l10n_util::GetStringFUTF16(
 551           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_SENTENCE_LINK,
 552           site_connection_details_,
 553           l10n_util::GetStringUTF16(ran_insecure_content ?
 554               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_ERROR :
 555               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_WARNING)));
 556     }
 557   }
 558
 559   uint16 cipher_suite =
 560       net::SSLConnectionStatusToCipherSuite(security_info.connection_status);
 561   if (security_info.security_bits > 0 && cipher_suite) {
 562     int ssl_version =
 563         net::SSLConnectionStatusToVersion(security_info.connection_status);
 564     const char* ssl_version_str;
 565     net::SSLVersionToString(&ssl_version_str, ssl_version);
 566     site_connection_details_ += ASCIIToUTF16("\n\n");
 567     site_connection_details_ += l10n_util::GetStringFUTF16(
 568         IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION,
 569         ASCIIToUTF16(ssl_version_str));
 570
 571     bool no_renegotiation =
 572         (security_info.connection_status &
 573          net::SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) != 0;
 574     const char *key_exchange, *cipher, *mac;
 575     bool is_aead;
 576     net::SSLCipherSuiteToStrings(
 577         &key_exchange, &cipher, &mac, &is_aead, cipher_suite);
 578
 579     site_connection_details_ += ASCIIToUTF16("\n\n");
 580     if (is_aead) {
 581       site_connection_details_ += l10n_util::GetStringFUTF16(
 582           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS_AEAD,
 583           ASCIIToUTF16(cipher), ASCIIToUTF16(key_exchange));
 584     } else {
 585       site_connection_details_ += l10n_util::GetStringFUTF16(
 586           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS,
 587           ASCIIToUTF16(cipher), ASCIIToUTF16(mac), ASCIIToUTF16(key_exchange));
 588     }
 589
 590     if (ssl_version == net::SSL_CONNECTION_VERSION_SSL3 &&
 591         site_connection_status_ < SITE_CONNECTION_STATUS_MIXED_CONTENT) {
 592       site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 593     }
 594
 595     const bool did_fallback = (security_info.connection_status &
 596                                net::SSL_CONNECTION_VERSION_FALLBACK) != 0;
 597     if (did_fallback) {
 598       site_connection_details_ += ASCIIToUTF16("\n\n");
 599       site_connection_details_ += l10n_util::GetStringUTF16(
 600           IDS_PAGE_INFO_SECURITY_TAB_FALLBACK_MESSAGE);
 601     }
 602
 603     if (no_renegotiation) {
 604       site_connection_details_ += ASCIIToUTF16("\n\n");
 605       site_connection_details_ += l10n_util::GetStringUTF16(
 606           IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE);
 607     }
 608   }
 609
 610   // Check if a user decision has been made to allow or deny certificates with
 611   // errors on this site.
 612   ChromeSSLHostStateDelegate* delegate =
 613       ChromeSSLHostStateDelegateFactory::GetForProfile(profile_);
 614   DCHECK(delegate);
 615   // Only show an SSL decision revoke button if the user has chosen to bypass
 616   // SSL host errors for this host in the past.
 617   show_ssl_decision_revoke_button_ = delegate->HasAllowException(url.host());
 618
 619   // By default select the Permissions Tab that displays all the site
 620   // permissions. In case of a connection error or an issue with the certificate
 621   // presented by the website, select the Connection Tab to draw the user's
 622   // attention to the issue. If the site does not provide a certificate because
 623   // it was loaded over an unencrypted connection, don't select the Connection
 624   // Tab.
 625   WebsiteSettingsUI::TabId tab_id = WebsiteSettingsUI::TAB_ID_PERMISSIONS;
 626   if (site_connection_status_ == SITE_CONNECTION_STATUS_ENCRYPTED_ERROR ||
 627       site_connection_status_ == SITE_CONNECTION_STATUS_MIXED_CONTENT ||
 628       site_connection_status_ == SITE_CONNECTION_STATUS_MIXED_SCRIPT ||
 629       site_identity_status_ == SITE_IDENTITY_STATUS_ERROR ||
 630       site_identity_status_ == SITE_IDENTITY_STATUS_CERT_REVOCATION_UNKNOWN ||
 631       site_identity_status_ == SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT ||
 632       site_identity_status_ ==
 633           SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM) {
 634     tab_id = WebsiteSettingsUI::TAB_ID_CONNECTION;
 635     RecordWebsiteSettingsAction(
 636       WEBSITE_SETTINGS_CONNECTION_TAB_SHOWN_IMMEDIATELY);
 637   }
 638
 639   ui_->SetSelectedTab(tab_id);
 640 }
 641
 642 void WebsiteSettings::PresentSitePermissions() {
 643   PermissionInfoList permission_info_list;
 644
 645   WebsiteSettingsUI::PermissionInfo permission_info;
 646   for (size_t i = 0; i < arraysize(kPermissionType); ++i) {
 647     permission_info.type = kPermissionType[i];
 648
 649     content_settings::SettingInfo info;
 650     scoped_ptr<base::Value> value =
 651         content_settings_->GetWebsiteSetting(
 652             site_url_, site_url_, permission_info.type, std::string(), &info);
 653     DCHECK(value.get());
 654     if (value->GetType() == base::Value::TYPE_INTEGER) {
 655       permission_info.setting =
 656           content_settings::ValueToContentSetting(value.get());
 657     } else {
 658       NOTREACHED();
 659     }
 660
 661     permission_info.source = info.source;
 662
 663     if (info.primary_pattern == ContentSettingsPattern::Wildcard() &&
 664         info.secondary_pattern == ContentSettingsPattern::Wildcard()) {
 665       permission_info.default_setting = permission_info.setting;
 666       permission_info.setting = CONTENT_SETTING_DEFAULT;
 667     } else {
 668       permission_info.default_setting =
 669           content_settings_->GetDefaultContentSetting(permission_info.type,
 670                                                       NULL);
 671     }
 672
 673     if (permission_info.setting != CONTENT_SETTING_DEFAULT &&
 674         permission_info.setting != permission_info.default_setting) {
 675       permission_info_list.push_back(permission_info);
 676     }
 677   }
 678
 679   ui_->SetPermissionInfo(permission_info_list);
 680 }
 681
 682 void WebsiteSettings::PresentSiteData() {
 683   CookieInfoList cookie_info_list;
 684   const LocalSharedObjectsCounter& allowed_objects =
 685       tab_specific_content_settings()->allowed_local_shared_objects();
 686   const LocalSharedObjectsCounter& blocked_objects =
 687       tab_specific_content_settings()->blocked_local_shared_objects();
 688
 689   // Add first party cookie and site data counts.
 690   WebsiteSettingsUI::CookieInfo cookie_info;
 691   cookie_info.cookie_source =
 692       l10n_util::GetStringUTF8(IDS_WEBSITE_SETTINGS_FIRST_PARTY_SITE_DATA);
 693   cookie_info.allowed = allowed_objects.GetObjectCountForDomain(site_url_);
 694   cookie_info.blocked = blocked_objects.GetObjectCountForDomain(site_url_);
 695   cookie_info.is_first_party = true;
 696   cookie_info_list.push_back(cookie_info);
 697
 698   // Add third party cookie counts.
 699   cookie_info.cookie_source = l10n_util::GetStringUTF8(
 700      IDS_WEBSITE_SETTINGS_THIRD_PARTY_SITE_DATA);
 701   cookie_info.allowed = allowed_objects.GetObjectCount() - cookie_info.allowed;
 702   cookie_info.blocked = blocked_objects.GetObjectCount() - cookie_info.blocked;
 703   cookie_info.is_first_party = false;
 704   cookie_info_list.push_back(cookie_info);
 705
 706   ui_->SetCookieInfo(cookie_info_list);
 707 }
 708
 709 void WebsiteSettings::PresentSiteIdentity() {
 710   // After initialization the status about the site's connection and its
 711   // identity must be available.
 712   DCHECK_NE(site_identity_status_, SITE_IDENTITY_STATUS_UNKNOWN);
 713   DCHECK_NE(site_connection_status_, SITE_CONNECTION_STATUS_UNKNOWN);
 714   WebsiteSettingsUI::IdentityInfo info;
 715   if (site_identity_status_ == SITE_IDENTITY_STATUS_EV_CERT)
 716     info.site_identity = UTF16ToUTF8(organization_name());
 717   else
 718     info.site_identity = UTF16ToUTF8(GetSimpleSiteName(site_url_, profile_));
 719
 720   info.connection_status = site_connection_status_;
 721   info.connection_status_description =
 722       UTF16ToUTF8(site_connection_details_);
 723   info.identity_status = site_identity_status_;
 724   info.identity_status_description =
 725       UTF16ToUTF8(site_identity_details_);
 726   info.cert_id = cert_id_;
 727   info.show_ssl_decision_revoke_button = show_ssl_decision_revoke_button_;
 728   ui_->SetIdentityInfo(info);
 729 }