src/chrome/browser/ui/website_settings/website_settings.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/ui/website_settings/website_settings.h"
   6
   7 #include <string>
   8 #include <vector>
   9
  10 #include "base/bind.h"
  11 #include "base/bind_helpers.h"
  12 #include "base/command_line.h"
  13 #include "base/i18n/time_formatting.h"
  14 #include "base/metrics/field_trial.h"
  15 #include "base/metrics/histogram.h"
  16 #include "base/strings/string_number_conversions.h"
  17 #include "base/strings/utf_string_conversions.h"
  18 #include "base/values.h"
  19 #include "chrome/browser/browsing_data/browsing_data_channel_id_helper.h"
  20 #include "chrome/browser/browsing_data/browsing_data_cookie_helper.h"
  21 #include "chrome/browser/browsing_data/browsing_data_database_helper.h"
  22 #include "chrome/browser/browsing_data/browsing_data_file_system_helper.h"
  23 #include "chrome/browser/browsing_data/browsing_data_indexed_db_helper.h"
  24 #include "chrome/browser/browsing_data/browsing_data_local_storage_helper.h"
  25 #include "chrome/browser/history/history_service_factory.h"
  26 #include "chrome/browser/profiles/profile.h"
  27 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate.h"
  28 #include "chrome/browser/ssl/chrome_ssl_host_state_delegate_factory.h"
  29 #include "chrome/browser/ssl/ssl_error_info.h"
  30 #include "chrome/browser/ui/website_settings/website_settings_infobar_delegate.h"
  31 #include "chrome/browser/ui/website_settings/website_settings_ui.h"
  32 #include "chrome/common/chrome_switches.h"
  33 #include "chrome/grit/chromium_strings.h"
  34 #include "chrome/grit/generated_resources.h"
  35 #include "components/content_settings/core/browser/content_settings_utils.h"
  36 #include "components/content_settings/core/browser/host_content_settings_map.h"
  37 #include "components/content_settings/core/browser/local_shared_objects_counter.h"
  38 #include "components/content_settings/core/common/content_settings_pattern.h"
  39 #include "content/public/browser/browser_thread.h"
  40 #include "content/public/browser/cert_store.h"
  41 #include "content/public/browser/user_metrics.h"
  42 #include "content/public/common/content_switches.h"
  43 #include "content/public/common/ssl_status.h"
  44 #include "content/public/common/url_constants.h"
  45 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
  46 #include "net/cert/cert_status_flags.h"
  47 #include "net/cert/x509_certificate.h"
  48 #include "net/ssl/ssl_cipher_suite_names.h"
  49 #include "net/ssl/ssl_connection_status_flags.h"
  50 #include "ui/base/l10n/l10n_util.h"
  51
  52 #if defined(OS_CHROMEOS)
  53 #include "chrome/browser/chromeos/policy/policy_cert_service.h"
  54 #include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
  55 #endif
  56
  57 using base::ASCIIToUTF16;
  58 using base::UTF8ToUTF16;
  59 using base::UTF16ToUTF8;
  60 using content::BrowserThread;
  61
  62 namespace {
  63
  64 // Events for UMA. Do not reorder or change!
  65 enum SSLCertificateDecisionsDidRevoke {
  66   USER_CERT_DECISIONS_NOT_REVOKED = 0,
  67   USER_CERT_DECISIONS_REVOKED,
  68   END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM
  69 };
  70
  71 // The list of content settings types to display on the Website Settings UI.
  72 ContentSettingsType kPermissionType[] = {
  73   CONTENT_SETTINGS_TYPE_IMAGES,
  74   CONTENT_SETTINGS_TYPE_JAVASCRIPT,
  75   CONTENT_SETTINGS_TYPE_PLUGINS,
  76   CONTENT_SETTINGS_TYPE_POPUPS,
  77   CONTENT_SETTINGS_TYPE_GEOLOCATION,
  78   CONTENT_SETTINGS_TYPE_NOTIFICATIONS,
  79   CONTENT_SETTINGS_TYPE_FULLSCREEN,
  80   CONTENT_SETTINGS_TYPE_MOUSELOCK,
  81   CONTENT_SETTINGS_TYPE_MEDIASTREAM,
  82   CONTENT_SETTINGS_TYPE_AUTOMATIC_DOWNLOADS,
  83   CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
  84 #if defined(OS_ANDROID)
  85   CONTENT_SETTINGS_TYPE_PUSH_MESSAGING,
  86 #endif
  87 };
  88
  89 bool CertificateTransparencyStatusMatch(
  90     const content::SignedCertificateTimestampIDStatusList& scts,
  91     net::ct::SCTVerifyStatus status) {
  92   for (content::SignedCertificateTimestampIDStatusList::const_iterator it =
  93            scts.begin();
  94        it != scts.end();
  95        ++it) {
  96     if (it->status == status)
  97       return true;
  98   }
  99
 100   return false;
 101 }
 102
 103 int GetSiteIdentityDetailsMessageByCTInfo(
 104     const content::SignedCertificateTimestampIDStatusList& scts,
 105     bool is_ev) {
 106   // No SCTs - no CT information.
 107   if (scts.empty())
 108     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_NO_CT
 109                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_NO_CT);
 110
 111   if (CertificateTransparencyStatusMatch(scts, net::ct::SCT_STATUS_OK))
 112     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_VERIFIED
 113                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_VERIFIED);
 114
 115   if (CertificateTransparencyStatusMatch(scts, net::ct::SCT_STATUS_INVALID))
 116     return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_INVALID
 117                   : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_INVALID);
 118
 119   // status is SCT_STATUS_LOG_UNKNOWN
 120   return (is_ev ? IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_EV_CT_UNVERIFIED
 121                 : IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_CT_UNVERIFIED);
 122 }
 123
 124 // This function will return SITE_IDENTITY_STATUS_CERT or
 125 // SITE_IDENTITY_STATUS_EV_CERT depending on |is_ev| unless there are SCTs
 126 // which failed verification, in which case it will return
 127 // SITE_IDENTITY_STATUS_ERROR.
 128 WebsiteSettings::SiteIdentityStatus GetSiteIdentityStatusByCTInfo(
 129     const content::SignedCertificateTimestampIDStatusList& scts,
 130     bool is_ev) {
 131   if (CertificateTransparencyStatusMatch(scts, net::ct::SCT_STATUS_INVALID))
 132     return WebsiteSettings::SITE_IDENTITY_STATUS_ERROR;
 133
 134   return is_ev ? WebsiteSettings::SITE_IDENTITY_STATUS_EV_CERT
 135                : WebsiteSettings::SITE_IDENTITY_STATUS_CERT;
 136 }
 137
 138 const char kRememberCertificateErrorDecisionsFieldTrialName[] =
 139     "RememberCertificateErrorDecisions";
 140 const char kRememberCertificateErrorDecisionsFieldTrialDefaultGroup[] =
 141     "Default";
 142 const char kRememberCertificateErrorDecisionsFieldTrialDisableGroup[] =
 143     "Disable";
 144 // Returns true if the user is in the experimental group or has the flag enabled
 145 // for remembering SSL error decisions, otherwise false.
 146 //
 147 // TODO(jww): The field trial is scheduled to end 2015/02/28. This should be
 148 // removed at that point unless the field trial or flag continues.
 149 bool InRememberCertificateErrorDecisionsGroup() {
 150   std::string group_name = base::FieldTrialList::FindFullName(
 151       kRememberCertificateErrorDecisionsFieldTrialName);
 152
 153   // The Default and Disable groups are the "old-style" forget-at-session
 154   // restart groups, so they do not get the button.
 155   bool in_experimental_group = !group_name.empty() &&
 156       group_name.compare(
 157           kRememberCertificateErrorDecisionsFieldTrialDefaultGroup) != 0 &&
 158       group_name.compare(
 159           kRememberCertificateErrorDecisionsFieldTrialDisableGroup) != 0;
 160   bool has_command_line_switch = CommandLine::ForCurrentProcess()->HasSwitch(
 161       switches::kRememberCertErrorDecisions);
 162   return in_experimental_group || has_command_line_switch;
 163 }
 164
 165 }  // namespace
 166
 167 WebsiteSettings::WebsiteSettings(
 168     WebsiteSettingsUI* ui,
 169     Profile* profile,
 170     TabSpecificContentSettings* tab_specific_content_settings,
 171     InfoBarService* infobar_service,
 172     const GURL& url,
 173     const content::SSLStatus& ssl,
 174     content::CertStore* cert_store)
 175     : TabSpecificContentSettings::SiteDataObserver(
 176           tab_specific_content_settings),
 177       ui_(ui),
 178       infobar_service_(infobar_service),
 179       show_info_bar_(false),
 180       site_url_(url),
 181       site_identity_status_(SITE_IDENTITY_STATUS_UNKNOWN),
 182       cert_id_(0),
 183       site_connection_status_(SITE_CONNECTION_STATUS_UNKNOWN),
 184       cert_store_(cert_store),
 185       content_settings_(profile->GetHostContentSettingsMap()),
 186       chrome_ssl_host_state_delegate_(
 187           ChromeSSLHostStateDelegateFactory::GetForProfile(profile)),
 188       did_revoke_user_ssl_decisions_(false) {
 189   Init(profile, url, ssl);
 190
 191   HistoryService* history_service = HistoryServiceFactory::GetForProfile(
 192       profile, Profile::EXPLICIT_ACCESS);
 193   if (history_service) {
 194     history_service->GetVisibleVisitCountToHost(
 195         site_url_,
 196         base::Bind(&WebsiteSettings::OnGotVisitCountToHost,
 197                    base::Unretained(this)),
 198         &visit_count_task_tracker_);
 199   }
 200
 201   PresentSitePermissions();
 202   PresentSiteData();
 203   PresentSiteIdentity();
 204   PresentHistoryInfo(base::Time());
 205
 206   // Every time the Website Settings UI is opened a |WebsiteSettings| object is
 207   // created. So this counts how ofter the Website Settings UI is opened.
 208   RecordWebsiteSettingsAction(WEBSITE_SETTINGS_OPENED);
 209 }
 210
 211 WebsiteSettings::~WebsiteSettings() {
 212 }
 213
 214 void WebsiteSettings::RecordWebsiteSettingsAction(
 215     WebsiteSettingsAction action) {
 216   UMA_HISTOGRAM_ENUMERATION("WebsiteSettings.Action",
 217                             action,
 218                             WEBSITE_SETTINGS_COUNT);
 219
 220   // Use a separate histogram to record actions if they are done on a page with
 221   // an HTTPS URL. Note that this *disregards* security status.
 222   if (site_url_.SchemeIs(url::kHttpsScheme)) {
 223     UMA_HISTOGRAM_ENUMERATION("WebsiteSettings.Action.HttpsUrl",
 224                               action,
 225                               WEBSITE_SETTINGS_COUNT);
 226   }
 227 }
 228
 229
 230 void WebsiteSettings::OnSitePermissionChanged(ContentSettingsType type,
 231                                               ContentSetting setting) {
 232   // Count how often a permission for a specific content type is changed using
 233   // the Website Settings UI.
 234   UMA_HISTOGRAM_COUNTS("WebsiteSettings.PermissionChanged", type);
 235
 236   // This is technically redundant given the histogram above, but putting the
 237   // total count of permission changes in another histogram makes it easier to
 238   // compare it against other kinds of actions in WebsiteSettings[PopupView].
 239   RecordWebsiteSettingsAction(WEBSITE_SETTINGS_CHANGED_PERMISSION);
 240
 241   ContentSettingsPattern primary_pattern;
 242   ContentSettingsPattern secondary_pattern;
 243   switch (type) {
 244     case CONTENT_SETTINGS_TYPE_GEOLOCATION:
 245     case CONTENT_SETTINGS_TYPE_MIDI_SYSEX:
 246       // TODO(markusheintz): The rule we create here should also change the
 247       // location permission for iframed content.
 248       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 249       secondary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 250       break;
 251     case CONTENT_SETTINGS_TYPE_NOTIFICATIONS:
 252       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 253       secondary_pattern = ContentSettingsPattern::Wildcard();
 254       break;
 255     case CONTENT_SETTINGS_TYPE_IMAGES:
 256     case CONTENT_SETTINGS_TYPE_JAVASCRIPT:
 257     case CONTENT_SETTINGS_TYPE_PLUGINS:
 258     case CONTENT_SETTINGS_TYPE_POPUPS:
 259     case CONTENT_SETTINGS_TYPE_FULLSCREEN:
 260     case CONTENT_SETTINGS_TYPE_MOUSELOCK:
 261     case CONTENT_SETTINGS_TYPE_AUTOMATIC_DOWNLOADS:
 262     case CONTENT_SETTINGS_TYPE_PUSH_MESSAGING:
 263       primary_pattern = ContentSettingsPattern::FromURL(site_url_);
 264       secondary_pattern = ContentSettingsPattern::Wildcard();
 265       break;
 266     case CONTENT_SETTINGS_TYPE_MEDIASTREAM: {
 267       // We need to use the same same patterns as other places like infobar code
 268       // to override the existing rule instead of creating the new one.
 269       primary_pattern = ContentSettingsPattern::FromURLNoWildcard(site_url_);
 270       secondary_pattern = ContentSettingsPattern::Wildcard();
 271       // Set permission for both microphone and camera.
 272       content_settings_->SetContentSetting(
 273           primary_pattern,
 274           secondary_pattern,
 275           CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC,
 276           std::string(),
 277           setting);
 278
 279       content_settings_->SetContentSetting(
 280           primary_pattern,
 281           secondary_pattern,
 282           CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
 283           std::string(),
 284           setting);
 285       break;
 286     }
 287     default:
 288       NOTREACHED() << "ContentSettingsType " << type << "is not supported.";
 289       break;
 290   }
 291
 292   if (type != CONTENT_SETTINGS_TYPE_MEDIASTREAM) {
 293     // Permission settings are specified via rules. There exists always at least
 294     // one rule for the default setting. Get the rule that currently defines
 295     // the permission for the given permission |type|. Then test whether the
 296     // existing rule is more specific than the rule we are about to create. If
 297     // the existing rule is more specific, than change the existing rule instead
 298     // of creating a new rule that would be hidden behind the existing rule.
 299     // This is not a concern for CONTENT_SETTINGS_TYPE_MEDIASTREAM since users
 300     // can not create media settings exceptions by hand.
 301     content_settings::SettingInfo info;
 302     scoped_ptr<base::Value> v =
 303         content_settings_->GetWebsiteSettingWithoutOverride(
 304             site_url_, site_url_, type, std::string(), &info);
 305     content_settings_->SetNarrowestWebsiteSetting(
 306         primary_pattern, secondary_pattern, type, std::string(), setting, info);
 307   } else {
 308     base::Value* value = NULL;
 309     if (setting != CONTENT_SETTING_DEFAULT)
 310       value = new base::FundamentalValue(setting);
 311     content_settings_->SetWebsiteSetting(
 312         primary_pattern, secondary_pattern, type, std::string(), value);
 313   }
 314
 315   show_info_bar_ = true;
 316
 317 // TODO(markusheintz): This is a temporary hack to fix issue:
 318 // http://crbug.com/144203.
 319 #if defined(OS_MACOSX)
 320   // Refresh the UI to reflect the new setting.
 321   PresentSitePermissions();
 322 #endif
 323 }
 324
 325 void WebsiteSettings::OnGotVisitCountToHost(bool found_visits,
 326                                             int visit_count,
 327                                             base::Time first_visit) {
 328   if (!found_visits) {
 329     // This indicates an error, such as the page's URL scheme wasn't
 330     // http/https.
 331     first_visit = base::Time();
 332   } else if (visit_count == 0) {
 333     first_visit = base::Time::Now();
 334   }
 335   PresentHistoryInfo(first_visit);
 336 }
 337
 338 void WebsiteSettings::OnSiteDataAccessed() {
 339   PresentSiteData();
 340 }
 341
 342 void WebsiteSettings::OnUIClosing() {
 343   if (show_info_bar_)
 344     WebsiteSettingsInfoBarDelegate::Create(infobar_service_);
 345
 346   SSLCertificateDecisionsDidRevoke user_decision =
 347       did_revoke_user_ssl_decisions_ ? USER_CERT_DECISIONS_REVOKED
 348                                      : USER_CERT_DECISIONS_NOT_REVOKED;
 349
 350   UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.did_user_revoke_decisions",
 351                             user_decision,
 352                             END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM);
 353 }
 354
 355 void WebsiteSettings::OnRevokeSSLErrorBypassButtonPressed() {
 356   DCHECK(chrome_ssl_host_state_delegate_);
 357   chrome_ssl_host_state_delegate_->RevokeUserAllowExceptionsHard(
 358       site_url().host());
 359   did_revoke_user_ssl_decisions_ = true;
 360 }
 361
 362 void WebsiteSettings::Init(Profile* profile,
 363                            const GURL& url,
 364                            const content::SSLStatus& ssl) {
 365   bool isChromeUINativeScheme = false;
 366 #if defined(OS_ANDROID)
 367   isChromeUINativeScheme = url.SchemeIs(chrome::kChromeUINativeScheme);
 368 #endif
 369
 370   if (url.SchemeIs(content::kChromeUIScheme) ||
 371       url.SchemeIs(url::kAboutScheme) || isChromeUINativeScheme) {
 372     site_identity_status_ = SITE_IDENTITY_STATUS_INTERNAL_PAGE;
 373     site_identity_details_ =
 374         l10n_util::GetStringUTF16(IDS_PAGE_INFO_INTERNAL_PAGE);
 375     site_connection_status_ = SITE_CONNECTION_STATUS_INTERNAL_PAGE;
 376     return;
 377   }
 378
 379   scoped_refptr<net::X509Certificate> cert;
 380
 381   // Identity section.
 382   base::string16 subject_name(UTF8ToUTF16(url.host()));
 383   if (subject_name.empty()) {
 384     subject_name.assign(
 385         l10n_util::GetStringUTF16(IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 386   }
 387
 388   cert_id_ = ssl.cert_id;
 389
 390   if (ssl.cert_id && !ssl.signed_certificate_timestamp_ids.empty()) {
 391     signed_certificate_timestamp_ids_.assign(
 392         ssl.signed_certificate_timestamp_ids.begin(),
 393         ssl.signed_certificate_timestamp_ids.end());
 394   }
 395
 396   if (ssl.cert_id &&
 397       cert_store_->RetrieveCert(ssl.cert_id, &cert) &&
 398       (!net::IsCertStatusError(ssl.cert_status) ||
 399        net::IsCertStatusMinorError(ssl.cert_status))) {
 400     // There are no major errors. Check for minor errors.
 401 #if defined(OS_CHROMEOS)
 402     policy::PolicyCertService* service =
 403         policy::PolicyCertServiceFactory::GetForProfile(profile);
 404     const bool used_policy_certs = service && service->UsedPolicyCertificates();
 405 #else
 406     const bool used_policy_certs = false;
 407 #endif
 408     if (used_policy_certs) {
 409       site_identity_status_ = SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT;
 410       site_identity_details_ = l10n_util::GetStringFUTF16(
 411           IDS_CERT_POLICY_PROVIDED_CERT_MESSAGE, UTF8ToUTF16(url.host()));
 412     } else if (net::IsCertStatusMinorError(ssl.cert_status)) {
 413       site_identity_status_ = SITE_IDENTITY_STATUS_CERT_REVOCATION_UNKNOWN;
 414       base::string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
 415       if (issuer_name.empty()) {
 416         issuer_name.assign(l10n_util::GetStringUTF16(
 417             IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 418       }
 419
 420       site_identity_details_.assign(l10n_util::GetStringFUTF16(
 421           GetSiteIdentityDetailsMessageByCTInfo(
 422               ssl.signed_certificate_timestamp_ids, false /* not EV */),
 423           issuer_name));
 424
 425       site_identity_details_ += ASCIIToUTF16("\n\n");
 426       if (ssl.cert_status & net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION) {
 427         site_identity_details_ += l10n_util::GetStringUTF16(
 428             IDS_PAGE_INFO_SECURITY_TAB_UNABLE_TO_CHECK_REVOCATION);
 429       } else if (ssl.cert_status & net::CERT_STATUS_NO_REVOCATION_MECHANISM) {
 430         site_identity_details_ += l10n_util::GetStringUTF16(
 431             IDS_PAGE_INFO_SECURITY_TAB_NO_REVOCATION_MECHANISM);
 432       } else {
 433         NOTREACHED() << "Need to specify string for this warning";
 434       }
 435     } else {
 436       if (ssl.cert_status & net::CERT_STATUS_IS_EV) {
 437         // EV HTTPS page.
 438         site_identity_status_ = GetSiteIdentityStatusByCTInfo(
 439             ssl.signed_certificate_timestamp_ids, true);
 440         DCHECK(!cert->subject().organization_names.empty());
 441         organization_name_ = UTF8ToUTF16(cert->subject().organization_names[0]);
 442         // An EV Cert is required to have a city (localityName) and country but
 443         // state is "if any".
 444         DCHECK(!cert->subject().locality_name.empty());
 445         DCHECK(!cert->subject().country_name.empty());
 446         base::string16 locality;
 447         if (!cert->subject().state_or_province_name.empty()) {
 448           locality = l10n_util::GetStringFUTF16(
 449               IDS_PAGEINFO_ADDRESS,
 450               UTF8ToUTF16(cert->subject().locality_name),
 451               UTF8ToUTF16(cert->subject().state_or_province_name),
 452               UTF8ToUTF16(cert->subject().country_name));
 453         } else {
 454           locality = l10n_util::GetStringFUTF16(
 455               IDS_PAGEINFO_PARTIAL_ADDRESS,
 456               UTF8ToUTF16(cert->subject().locality_name),
 457               UTF8ToUTF16(cert->subject().country_name));
 458         }
 459         DCHECK(!cert->subject().organization_names.empty());
 460         site_identity_details_.assign(l10n_util::GetStringFUTF16(
 461             GetSiteIdentityDetailsMessageByCTInfo(
 462                 ssl.signed_certificate_timestamp_ids, true /* is EV */),
 463             UTF8ToUTF16(cert->subject().organization_names[0]),
 464             locality,
 465             UTF8ToUTF16(cert->issuer().GetDisplayName())));
 466       } else {
 467         // Non-EV OK HTTPS page.
 468         site_identity_status_ = GetSiteIdentityStatusByCTInfo(
 469             ssl.signed_certificate_timestamp_ids, false);
 470         base::string16 issuer_name(
 471             UTF8ToUTF16(cert->issuer().GetDisplayName()));
 472         if (issuer_name.empty()) {
 473           issuer_name.assign(l10n_util::GetStringUTF16(
 474               IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
 475         }
 476
 477         site_identity_details_.assign(l10n_util::GetStringFUTF16(
 478             GetSiteIdentityDetailsMessageByCTInfo(
 479                 ssl.signed_certificate_timestamp_ids, false /* not EV */),
 480             issuer_name));
 481       }
 482       // The date after which no new SHA-1 certificates may be issued.
 483       // 2016-01-01 00:00:00 UTC
 484       static const int64_t kSHA1LastIssuanceDate = INT64_C(13096080000000000);
 485       if ((ssl.cert_status & net::CERT_STATUS_SHA1_SIGNATURE_PRESENT) &&
 486           cert->valid_expiry() >
 487               base::Time::FromInternalValue(kSHA1LastIssuanceDate) &&
 488           base::FieldTrialList::FindFullName("SHA1IdentityUIWarning") ==
 489               "Enabled") {
 490         site_identity_status_ =
 491             SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM;
 492         site_identity_details_ +=
 493             UTF8ToUTF16("\n\n") +
 494             l10n_util::GetStringUTF16(
 495                 IDS_PAGE_INFO_SECURITY_TAB_DEPRECATED_SIGNATURE_ALGORITHM);
 496       }
 497     }
 498   } else {
 499     // HTTP or HTTPS with errors (not warnings).
 500     site_identity_details_.assign(l10n_util::GetStringUTF16(
 501         IDS_PAGE_INFO_SECURITY_TAB_INSECURE_IDENTITY));
 502     if (ssl.security_style == content::SECURITY_STYLE_UNAUTHENTICATED)
 503       site_identity_status_ = SITE_IDENTITY_STATUS_NO_CERT;
 504     else
 505       site_identity_status_ = SITE_IDENTITY_STATUS_ERROR;
 506
 507     const base::string16 bullet = UTF8ToUTF16("\n • ");
 508     std::vector<SSLErrorInfo> errors;
 509     SSLErrorInfo::GetErrorsForCertStatus(ssl.cert_id, ssl.cert_status,
 510                                          url, &errors);
 511     for (size_t i = 0; i < errors.size(); ++i) {
 512       site_identity_details_ += bullet;
 513       site_identity_details_ += errors[i].short_description();
 514     }
 515
 516     if (ssl.cert_status & net::CERT_STATUS_NON_UNIQUE_NAME) {
 517       site_identity_details_ += ASCIIToUTF16("\n\n");
 518       site_identity_details_ += l10n_util::GetStringUTF16(
 519           IDS_PAGE_INFO_SECURITY_TAB_NON_UNIQUE_NAME);
 520     }
 521   }
 522
 523   // Site Connection
 524   // We consider anything less than 80 bits encryption to be weak encryption.
 525   // TODO(wtc): Bug 1198735: report mixed/unsafe content for unencrypted and
 526   // weakly encrypted connections.
 527   site_connection_status_ = SITE_CONNECTION_STATUS_UNKNOWN;
 528
 529   if (ssl.security_style == content::SECURITY_STYLE_UNKNOWN) {
 530     // Page is still loading, so SSL status is not yet available. Say nothing.
 531     DCHECK_EQ(ssl.security_bits, -1);
 532     site_connection_status_ = SITE_CONNECTION_STATUS_UNENCRYPTED;
 533
 534     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 535         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
 536         subject_name));
 537   } else if (ssl.security_style == content::SECURITY_STYLE_UNAUTHENTICATED) {
 538     // HTTPS without a certificate, or not HTTPS.
 539     DCHECK(!ssl.cert_id);
 540     site_connection_status_ = SITE_CONNECTION_STATUS_UNENCRYPTED;
 541
 542     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 543         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
 544         subject_name));
 545   } else if (ssl.security_bits < 0) {
 546     // Security strength is unknown.  Say nothing.
 547     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 548   } else if (ssl.security_bits == 0) {
 549     DCHECK_NE(ssl.security_style, content::SECURITY_STYLE_UNAUTHENTICATED);
 550     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 551     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 552         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
 553         subject_name));
 554   } else if (ssl.security_bits < 80) {
 555     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 556     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 557         IDS_PAGE_INFO_SECURITY_TAB_WEAK_ENCRYPTION_CONNECTION_TEXT,
 558         subject_name));
 559   } else {
 560     site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED;
 561     site_connection_details_.assign(l10n_util::GetStringFUTF16(
 562         IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_CONNECTION_TEXT,
 563         subject_name,
 564         base::IntToString16(ssl.security_bits)));
 565     if (ssl.content_status) {
 566       bool ran_insecure_content =
 567           !!(ssl.content_status & content::SSLStatus::RAN_INSECURE_CONTENT);
 568       site_connection_status_ = ran_insecure_content ?
 569           SITE_CONNECTION_STATUS_ENCRYPTED_ERROR
 570           : SITE_CONNECTION_STATUS_MIXED_CONTENT;
 571       site_connection_details_.assign(l10n_util::GetStringFUTF16(
 572           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_SENTENCE_LINK,
 573           site_connection_details_,
 574           l10n_util::GetStringUTF16(ran_insecure_content ?
 575               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_ERROR :
 576               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_WARNING)));
 577     }
 578   }
 579
 580   uint16 cipher_suite =
 581       net::SSLConnectionStatusToCipherSuite(ssl.connection_status);
 582   if (ssl.security_bits > 0 && cipher_suite) {
 583     int ssl_version =
 584         net::SSLConnectionStatusToVersion(ssl.connection_status);
 585     const char* ssl_version_str;
 586     net::SSLVersionToString(&ssl_version_str, ssl_version);
 587     site_connection_details_ += ASCIIToUTF16("\n\n");
 588     site_connection_details_ += l10n_util::GetStringFUTF16(
 589         IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION,
 590         ASCIIToUTF16(ssl_version_str));
 591
 592     bool no_renegotiation =
 593         (ssl.connection_status &
 594         net::SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) != 0;
 595     const char *key_exchange, *cipher, *mac;
 596     bool is_aead;
 597     net::SSLCipherSuiteToStrings(
 598         &key_exchange, &cipher, &mac, &is_aead, cipher_suite);
 599
 600     site_connection_details_ += ASCIIToUTF16("\n\n");
 601     if (is_aead) {
 602       site_connection_details_ += l10n_util::GetStringFUTF16(
 603           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS_AEAD,
 604           ASCIIToUTF16(cipher), ASCIIToUTF16(key_exchange));
 605     } else {
 606       site_connection_details_ += l10n_util::GetStringFUTF16(
 607           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS,
 608           ASCIIToUTF16(cipher), ASCIIToUTF16(mac), ASCIIToUTF16(key_exchange));
 609     }
 610
 611     if (ssl_version == net::SSL_CONNECTION_VERSION_SSL3 &&
 612         site_connection_status_ < SITE_CONNECTION_STATUS_MIXED_CONTENT) {
 613       site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
 614     }
 615
 616     const bool did_fallback =
 617         (ssl.connection_status & net::SSL_CONNECTION_VERSION_FALLBACK) != 0;
 618     if (did_fallback) {
 619       site_connection_details_ += ASCIIToUTF16("\n\n");
 620       site_connection_details_ += l10n_util::GetStringUTF16(
 621           IDS_PAGE_INFO_SECURITY_TAB_FALLBACK_MESSAGE);
 622     }
 623
 624     if (no_renegotiation) {
 625       site_connection_details_ += ASCIIToUTF16("\n\n");
 626       site_connection_details_ += l10n_util::GetStringUTF16(
 627           IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE);
 628     }
 629   }
 630
 631   // Check if a user decision has been made to allow or deny certificates with
 632   // errors on this site.
 633   ChromeSSLHostStateDelegate* delegate =
 634       ChromeSSLHostStateDelegateFactory::GetForProfile(profile);
 635   DCHECK(delegate);
 636   // Only show an SSL decision revoke button if both the user has chosen to
 637   // bypass SSL host errors for this host in the past and the user is not using
 638   // the traditional "forget-at-session-restart" error decision memory.
 639   show_ssl_decision_revoke_button_ = delegate->HasAllowException(url.host()) &&
 640                                      InRememberCertificateErrorDecisionsGroup();
 641
 642   // By default select the permissions tab that displays all the site
 643   // permissions. In case of a connection error or an issue with the
 644   // certificate presented by the website, select the connection tab to draw
 645   // the user's attention to the issue. If the site does not provide a
 646   // certificate because it was loaded over an unencrypted connection, don't
 647   // select the connection tab.
 648   WebsiteSettingsUI::TabId tab_id = WebsiteSettingsUI::TAB_ID_PERMISSIONS;
 649   if (site_connection_status_ == SITE_CONNECTION_STATUS_ENCRYPTED_ERROR ||
 650       site_connection_status_ == SITE_CONNECTION_STATUS_MIXED_CONTENT ||
 651       site_identity_status_ == SITE_IDENTITY_STATUS_ERROR ||
 652       site_identity_status_ == SITE_IDENTITY_STATUS_CERT_REVOCATION_UNKNOWN ||
 653       site_identity_status_ == SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT ||
 654       site_identity_status_ ==
 655           SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM) {
 656     tab_id = WebsiteSettingsUI::TAB_ID_CONNECTION;
 657     RecordWebsiteSettingsAction(
 658       WEBSITE_SETTINGS_CONNECTION_TAB_SHOWN_IMMEDIATELY);
 659   }
 660   ui_->SetSelectedTab(tab_id);
 661 }
 662
 663 void WebsiteSettings::PresentSitePermissions() {
 664   PermissionInfoList permission_info_list;
 665
 666   WebsiteSettingsUI::PermissionInfo permission_info;
 667   for (size_t i = 0; i < arraysize(kPermissionType); ++i) {
 668     permission_info.type = kPermissionType[i];
 669     if (permission_info.type == CONTENT_SETTINGS_TYPE_MIDI_SYSEX) {
 670       const CommandLine* command_line = CommandLine::ForCurrentProcess();
 671       if (!command_line->HasSwitch(switches::kEnableWebMIDI))
 672         continue;
 673     }
 674
 675     content_settings::SettingInfo info;
 676     if (permission_info.type == CONTENT_SETTINGS_TYPE_MEDIASTREAM) {
 677       scoped_ptr<base::Value> mic_value =
 678           content_settings_->GetWebsiteSettingWithoutOverride(
 679               site_url_,
 680               site_url_,
 681               CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC,
 682               std::string(),
 683               &info);
 684       ContentSetting mic_setting =
 685           content_settings::ValueToContentSetting(mic_value.get());
 686
 687       scoped_ptr<base::Value> camera_value =
 688           content_settings_->GetWebsiteSettingWithoutOverride(
 689               site_url_,
 690               site_url_,
 691               CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
 692               std::string(),
 693               &info);
 694       ContentSetting camera_setting =
 695           content_settings::ValueToContentSetting(camera_value.get());
 696
 697       if (mic_setting != camera_setting || mic_setting == CONTENT_SETTING_ASK)
 698         permission_info.setting = CONTENT_SETTING_DEFAULT;
 699       else
 700         permission_info.setting = mic_setting;
 701     } else {
 702       scoped_ptr<base::Value> value =
 703           content_settings_->GetWebsiteSettingWithoutOverride(
 704               site_url_, site_url_, permission_info.type, std::string(), &info);
 705       DCHECK(value.get());
 706       if (value->GetType() == base::Value::TYPE_INTEGER) {
 707         permission_info.setting =
 708             content_settings::ValueToContentSetting(value.get());
 709       } else {
 710         NOTREACHED();
 711       }
 712     }
 713
 714     permission_info.source = info.source;
 715
 716     if (info.primary_pattern == ContentSettingsPattern::Wildcard() &&
 717         info.secondary_pattern == ContentSettingsPattern::Wildcard() &&
 718         permission_info.type != CONTENT_SETTINGS_TYPE_MEDIASTREAM) {
 719       permission_info.default_setting = permission_info.setting;
 720       permission_info.setting = CONTENT_SETTING_DEFAULT;
 721     } else {
 722       permission_info.default_setting =
 723           content_settings_->GetDefaultContentSetting(permission_info.type,
 724                                                       NULL);
 725     }
 726     permission_info_list.push_back(permission_info);
 727   }
 728
 729   ui_->SetPermissionInfo(permission_info_list);
 730 }
 731
 732 void WebsiteSettings::PresentSiteData() {
 733   CookieInfoList cookie_info_list;
 734   const LocalSharedObjectsCounter& allowed_objects =
 735       tab_specific_content_settings()->allowed_local_shared_objects();
 736   const LocalSharedObjectsCounter& blocked_objects =
 737       tab_specific_content_settings()->blocked_local_shared_objects();
 738
 739   // Add first party cookie and site data counts.
 740   WebsiteSettingsUI::CookieInfo cookie_info;
 741   std::string cookie_source =
 742       net::registry_controlled_domains::GetDomainAndRegistry(
 743           site_url_,
 744           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 745   if (cookie_source.empty())
 746     cookie_source = site_url_.host();
 747   cookie_info.cookie_source = cookie_source;
 748   cookie_info.allowed = allowed_objects.GetObjectCountForDomain(site_url_);
 749   cookie_info.blocked = blocked_objects.GetObjectCountForDomain(site_url_);
 750   cookie_info_list.push_back(cookie_info);
 751
 752   // Add third party cookie counts.
 753   cookie_info.cookie_source = l10n_util::GetStringUTF8(
 754      IDS_WEBSITE_SETTINGS_THIRD_PARTY_SITE_DATA);
 755   cookie_info.allowed = allowed_objects.GetObjectCount() - cookie_info.allowed;
 756   cookie_info.blocked = blocked_objects.GetObjectCount() - cookie_info.blocked;
 757   cookie_info_list.push_back(cookie_info);
 758
 759   ui_->SetCookieInfo(cookie_info_list);
 760 }
 761
 762 void WebsiteSettings::PresentSiteIdentity() {
 763   // After initialization the status about the site's connection
 764   // and it's identity must be available.
 765   DCHECK_NE(site_identity_status_, SITE_IDENTITY_STATUS_UNKNOWN);
 766   DCHECK_NE(site_connection_status_, SITE_CONNECTION_STATUS_UNKNOWN);
 767   WebsiteSettingsUI::IdentityInfo info;
 768   if (site_identity_status_ == SITE_IDENTITY_STATUS_EV_CERT)
 769     info.site_identity = UTF16ToUTF8(organization_name());
 770   else
 771     info.site_identity = site_url_.host();
 772
 773   info.connection_status = site_connection_status_;
 774   info.connection_status_description =
 775       UTF16ToUTF8(site_connection_details_);
 776   info.identity_status = site_identity_status_;
 777   info.identity_status_description =
 778       UTF16ToUTF8(site_identity_details_);
 779   info.cert_id = cert_id_;
 780   info.signed_certificate_timestamp_ids.assign(
 781       signed_certificate_timestamp_ids_.begin(),
 782       signed_certificate_timestamp_ids_.end());
 783   info.show_ssl_decision_revoke_button = show_ssl_decision_revoke_button_;
 784   ui_->SetIdentityInfo(info);
 785 }
 786
 787 void WebsiteSettings::PresentHistoryInfo(base::Time first_visit) {
 788   if (first_visit == base::Time()) {
 789     ui_->SetFirstVisit(base::string16());
 790     return;
 791   }
 792
 793   bool visited_before_today = false;
 794   base::Time today = base::Time::Now().LocalMidnight();
 795   base::Time first_visit_midnight = first_visit.LocalMidnight();
 796   visited_before_today = (first_visit_midnight < today);
 797
 798   base::string16 first_visit_text;
 799   if (visited_before_today) {
 800     first_visit_text = l10n_util::GetStringFUTF16(
 801         IDS_PAGE_INFO_SECURITY_TAB_VISITED_BEFORE_TODAY,
 802         base::TimeFormatShortDate(first_visit));
 803   } else {
 804     first_visit_text = l10n_util::GetStringUTF16(
 805         IDS_PAGE_INFO_SECURITY_TAB_FIRST_VISITED_TODAY);
 806   }
 807   ui_->SetFirstVisit(first_visit_text);
 808 }