page_info.h 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_PAGE_INFO_PAGE_INFO_H_
  5. #define COMPONENTS_PAGE_INFO_PAGE_INFO_H_
  6. #include <string>
  7. #include <vector>
  8. #include "base/gtest_prod_util.h"
  9. #include "base/memory/raw_ptr.h"
  10. #include "base/time/time.h"
  11. #include "build/build_config.h"
  12. #include "components/content_settings/core/common/content_settings.h"
  13. #include "components/content_settings/core/common/content_settings_types.h"
  14. #include "components/safe_browsing/buildflags.h"
  15. #include "components/security_state/core/security_state.h"
  16. #include "content/public/browser/web_contents.h"
  17. namespace content_settings {
  18. class PageSpecificContentSettings;
  19. }
  20. namespace net {
  21. class X509Certificate;
  22. }
  23. namespace permissions {
  24. class ObjectPermissionContextBase;
  25. }
  26. namespace ui {
  27. class Event;
  28. }
  29. class GURL;
  30. class HostContentSettingsMap;
  31. class PageInfoDelegate;
  32. class PageInfoUI;
  33. // The |PageInfo| provides information about a website's permissions,
  34. // connection state and its identity. It owns a UI that displays the
  35. // information and allows users to change the permissions. |PageInfo|
  36. // objects must be created on the heap. They destroy themselves after the UI is
  37. // closed.
  38. class PageInfo {
  39. public:
  40. // Status of a connection to a website.
  41. enum SiteConnectionStatus {
  42. SITE_CONNECTION_STATUS_UNKNOWN = 0, // No status available.
  43. SITE_CONNECTION_STATUS_ENCRYPTED, // Connection is encrypted.
  44. SITE_CONNECTION_STATUS_INSECURE_PASSIVE_SUBRESOURCE, // Non-secure passive
  45. // content.
  46. SITE_CONNECTION_STATUS_INSECURE_FORM_ACTION, // Non-secure form
  47. // target.
  48. SITE_CONNECTION_STATUS_INSECURE_ACTIVE_SUBRESOURCE, // Non-secure active
  49. // content.
  50. SITE_CONNECTION_STATUS_UNENCRYPTED, // Connection is not encrypted.
  51. SITE_CONNECTION_STATUS_ENCRYPTED_ERROR, // Connection error occurred.
  52. SITE_CONNECTION_STATUS_INTERNAL_PAGE, // Internal site.
  53. };
  54. // Validation status of a website's identity.
  55. enum SiteIdentityStatus {
  56. // No status about the website's identity available.
  57. SITE_IDENTITY_STATUS_UNKNOWN = 0,
  58. // The website provided a valid certificate.
  59. SITE_IDENTITY_STATUS_CERT,
  60. // The website provided a valid EV certificate.
  61. SITE_IDENTITY_STATUS_EV_CERT,
  62. // Site identity could not be verified because the site did not provide a
  63. // certificate. This is the expected state for HTTP connections.
  64. SITE_IDENTITY_STATUS_NO_CERT,
  65. // An error occured while verifying the site identity.
  66. SITE_IDENTITY_STATUS_ERROR,
  67. // The site is a trusted internal chrome page.
  68. SITE_IDENTITY_STATUS_INTERNAL_PAGE,
  69. // The profile has accessed data using an administrator-provided
  70. // certificate, so the administrator might be able to intercept data.
  71. SITE_IDENTITY_STATUS_ADMIN_PROVIDED_CERT,
  72. // The website provided a valid certificate, but the certificate or chain
  73. // is using a deprecated signature algorithm.
  74. SITE_IDENTITY_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
  75. };
  76. // Safe Browsing status of a website.
  77. enum SafeBrowsingStatus {
  78. SAFE_BROWSING_STATUS_NONE = 0,
  79. // The website has been flagged by Safe Browsing as dangerous for
  80. // containing malware, social engineering, unwanted software, or password
  81. // reuse on a low reputation site.
  82. SAFE_BROWSING_STATUS_MALWARE,
  83. SAFE_BROWSING_STATUS_SOCIAL_ENGINEERING,
  84. SAFE_BROWSING_STATUS_UNWANTED_SOFTWARE,
  85. SAFE_BROWSING_STATUS_SAVED_PASSWORD_REUSE,
  86. SAFE_BROWSING_STATUS_SIGNED_IN_SYNC_PASSWORD_REUSE,
  87. SAFE_BROWSING_STATUS_SIGNED_IN_NON_SYNC_PASSWORD_REUSE,
  88. SAFE_BROWSING_STATUS_ENTERPRISE_PASSWORD_REUSE,
  89. SAFE_BROWSING_STATUS_BILLING,
  90. };
  91. // Events for UMA. Do not reorder or change! Exposed in header so enum is
  92. // accessible from test.
  93. enum SSLCertificateDecisionsDidRevoke {
  94. USER_CERT_DECISIONS_NOT_REVOKED = 0,
  95. USER_CERT_DECISIONS_REVOKED = 1,
  96. END_OF_SSL_CERTIFICATE_DECISIONS_DID_REVOKE_ENUM
  97. };
  98. // UMA statistics for PageInfo. Do not reorder or remove existing
  99. // fields. A Java counterpart will be generated for this enum.
  100. // GENERATED_JAVA_ENUM_PACKAGE: org.chromium.components.page_info
  101. // All values here should have corresponding entries in
  102. // WebsiteSettingsAction area of enums.xml.
  103. enum PageInfoAction {
  104. PAGE_INFO_OPENED = 0,
  105. // No longer used; indicated actions for the old version of Page Info that
  106. // had a "Permissions" tab and a "Connection" tab.
  107. // PAGE_INFO_PERMISSIONS_TAB_SELECTED = 1,
  108. // PAGE_INFO_CONNECTION_TAB_SELECTED = 2,
  109. // PAGE_INFO_CONNECTION_TAB_SHOWN_IMMEDIATELY = 3,
  110. PAGE_INFO_COOKIES_DIALOG_OPENED = 4,
  111. PAGE_INFO_CHANGED_PERMISSION = 5,
  112. PAGE_INFO_CERTIFICATE_DIALOG_OPENED = 6,
  113. // No longer used; indicated a UI viewer for SCTs.
  114. // PAGE_INFO_TRANSPARENCY_VIEWER_OPENED = 7,
  115. PAGE_INFO_CONNECTION_HELP_OPENED = 8,
  116. PAGE_INFO_SITE_SETTINGS_OPENED = 9,
  117. PAGE_INFO_SECURITY_DETAILS_OPENED = 10,
  118. PAGE_INFO_COOKIES_ALLOWED_FOR_SITE = 11,
  119. PAGE_INFO_COOKIES_BLOCKED_FOR_SITE = 12,
  120. PAGE_INFO_COOKIES_CLEARED = 13,
  121. PAGE_INFO_PERMISSION_DIALOG_OPENED = 14,
  122. PAGE_INFO_PERMISSIONS_CLEARED = 15,
  123. // No longer used; indicated permission change but was a duplicate metric.
  124. // PAGE_INFO_PERMISSIONS_CHANGED = 16,
  125. PAGE_INFO_FORGET_SITE_OPENED = 17,
  126. PAGE_INFO_FORGET_SITE_CLEARED = 18,
  127. PAGE_INFO_HISTORY_OPENED = 19,
  128. PAGE_INFO_HISTORY_ENTRY_REMOVED = 20,
  129. PAGE_INFO_HISTORY_ENTRY_CLICKED = 21,
  130. PAGE_INFO_PASSWORD_REUSE_ALLOWED = 22,
  131. PAGE_INFO_CHANGE_PASSWORD_PRESSED = 23,
  132. PAGE_INFO_SAFETY_TIP_HELP_OPENED = 24,
  133. PAGE_INFO_CHOOSER_OBJECT_DELETED = 25,
  134. PAGE_INFO_RESET_DECISIONS_CLICKED = 26,
  135. PAGE_INFO_STORE_INFO_CLICKED = 27,
  136. PAGE_INFO_ABOUT_THIS_SITE_PAGE_OPENED = 28,
  137. PAGE_INFO_ABOUT_THIS_SITE_SOURCE_LINK_CLICKED = 29,
  138. PAGE_INFO_AD_PERSONALIZATION_PAGE_OPENED = 30,
  139. PAGE_INFO_AD_PERSONALIZATION_SETTINGS_OPENED = 31,
  140. PAGE_INFO_ABOUT_THIS_SITE_MORE_ABOUT_CLICKED = 32,
  141. PAGE_INFO_COOKIES_PAGE_OPENED = 33,
  142. PAGE_INFO_COOKIES_SETTINGS_OPENED = 34,
  143. PAGE_INFO_ALL_SITES_OPENED = 35,
  144. kMaxValue = PAGE_INFO_ALL_SITES_OPENED
  145. };
  146. struct ChooserUIInfo {
  147. ContentSettingsType content_settings_type;
  148. int description_string_id;
  149. int allowed_by_policy_description_string_id;
  150. int delete_tooltip_string_id;
  151. };
  152. // |PermissionInfo| contains information about a single permission |type| for
  153. // the current website.
  154. struct PermissionInfo {
  155. PermissionInfo() = default;
  156. // Site permission |type|.
  157. ContentSettingsType type = ContentSettingsType::DEFAULT;
  158. // The current value for the permission |type| (e.g. ALLOW or BLOCK).
  159. ContentSetting setting = CONTENT_SETTING_DEFAULT;
  160. // The global default settings for this permission |type|.
  161. ContentSetting default_setting = CONTENT_SETTING_DEFAULT;
  162. // The settings source e.g. user, extensions, policy, ... .
  163. content_settings::SettingSource source =
  164. content_settings::SETTING_SOURCE_NONE;
  165. bool is_one_time = false;
  166. };
  167. // Creates a PageInfo for the passed |url| using the given |ssl| status
  168. // object to determine the status of the site's connection. Computes the UI
  169. // inputs and records page info opened action. It is assumed that this is
  170. // created when page info dialog is opened and destroyed when the dialog is
  171. // closed.
  172. PageInfo(std::unique_ptr<PageInfoDelegate> delegate,
  173. content::WebContents* web_contents,
  174. const GURL& url);
  175. PageInfo(const PageInfo&) = delete;
  176. PageInfo& operator=(const PageInfo&) = delete;
  177. ~PageInfo();
  178. // Checks whether this permission is currently the factory default, as set by
  179. // Chrome. Specifically, that the following three conditions are true:
  180. // - The current active setting comes from the default or pref provider.
  181. // - The setting is the factory default setting (as opposed to a global
  182. // default setting set by the user).
  183. // - The setting is a wildcard setting applying to all origins (which can
  184. // only be set from the default provider).
  185. static bool IsPermissionFactoryDefault(const PermissionInfo& info,
  186. bool is_incognito);
  187. // Returns whether this page info is for an internal page.
  188. static bool IsFileOrInternalPage(const GURL& url);
  189. // Initializes the current UI and calls present data methods on it to notify
  190. // the current UI about the data it is subscribed to.
  191. void InitializeUiState(PageInfoUI* ui, base::OnceClosure done);
  192. // This method is called to update the presenter's security state and forwards
  193. // that change on to the UI to be redrawn.
  194. void UpdateSecurityState();
  195. void RecordPageInfoAction(PageInfoAction action);
  196. void UpdatePermissions();
  197. // This method is called when ever a permission setting is changed.
  198. void OnSitePermissionChanged(ContentSettingsType type,
  199. ContentSetting value,
  200. bool is_one_time);
  201. // This method is called whenever access to an object is revoked.
  202. void OnSiteChosenObjectDeleted(const ChooserUIInfo& ui_info,
  203. const base::Value& object);
  204. // This method is called by the UI when the UI is closing.
  205. // If specified, |reload_prompt| is set to whether closing the UI resulted in
  206. // a prompt to the user to reload the page.
  207. void OnUIClosing(bool* reload_prompt);
  208. // This method is called when the revoke SSL error bypass button is pressed.
  209. void OnRevokeSSLErrorBypassButtonPressed();
  210. // Handles opening the link to show more site settings and records the event.
  211. void OpenSiteSettingsView();
  212. // Handles opening the link to show cookies settings and records the event.
  213. void OpenCookiesSettingsView();
  214. // Handles opening the link to show all sites settings and records the event.
  215. void OpenAllSitesView();
  216. // Handles opening the cookies dialog and records the event.
  217. void OpenCookiesDialog();
  218. // Handles opening the certificate dialog and records the event.
  219. void OpenCertificateDialog(net::X509Certificate* certificate);
  220. // Handles opening the safery tip help center page.
  221. void OpenSafetyTipHelpCenterPage();
  222. // Handles opening the connection help center page and records the event.
  223. void OpenConnectionHelpCenterPage(const ui::Event& event);
  224. // Handles opening the settings page for a permission.
  225. void OpenContentSettingsExceptions(ContentSettingsType content_settings_type);
  226. // This method is called when the user pressed "Change password" button.
  227. void OnChangePasswordButtonPressed();
  228. // This method is called when the user pressed "Mark as legitimate" button.
  229. void OnAllowlistPasswordReuseButtonPressed();
  230. // Return a pointer to the ObjectPermissionContextBase corresponding to the
  231. // content settings type, |type|. Returns nullptr for content settings
  232. // for which there's no ObjectPermissionContextBase.
  233. permissions::ObjectPermissionContextBase* GetChooserContextFromUIInfo(
  234. const ChooserUIInfo& ui_info) const;
  235. void SetAboutThisSiteShown(bool was_about_this_site_shown) {
  236. was_about_this_site_shown_ = was_about_this_site_shown;
  237. }
  238. // Accessors.
  239. const SiteConnectionStatus& site_connection_status() const {
  240. return site_connection_status_;
  241. }
  242. const GURL& site_url() const { return site_url_; }
  243. const SiteIdentityStatus& site_identity_status() const {
  244. return site_identity_status_;
  245. }
  246. const SafeBrowsingStatus& safe_browsing_status() const {
  247. return safe_browsing_status_;
  248. }
  249. // Returns site origin in a concise and human-friendly way, without the
  250. // HTTP/HTTPS scheme, the username and password, the path and trivial
  251. // subdomains.
  252. std::u16string GetSimpleSiteName() const;
  253. // Retrieves all the permissions that are shown in Page Info.
  254. // Exposed for testing.
  255. static std::vector<ContentSettingsType> GetAllPermissionsForTesting();
  256. PageInfoUI* ui_for_testing() const { return ui_; }
  257. void SetSiteNameForTesting(const std::u16string& site_name);
  258. private:
  259. FRIEND_TEST_ALL_PREFIXES(PageInfoTest,
  260. NonFactoryDefaultAndRecentlyChangedPermissionsShown);
  261. FRIEND_TEST_ALL_PREFIXES(PageInfoTest, IncognitoPermissionsEmptyByDefault);
  262. FRIEND_TEST_ALL_PREFIXES(PageInfoTest, IncognitoPermissionsDontShowAsk);
  263. // Populates this object's UI state with provided security context. This
  264. // function does not update visible UI-- that's part of Present*().
  265. void ComputeUIInputs(const GURL& url);
  266. // Sets (presents) the information about the site's permissions in the |ui_|.
  267. void PresentSitePermissions();
  268. // Helper function which `PresentSiteData` calls after the ignored empty
  269. // storage keys have been updated.
  270. void PresentSiteDataInternal(base::OnceClosure done);
  271. // Sets (presents) the information about the site's data in the |ui_|.
  272. void PresentSiteData(base::OnceClosure done);
  273. // Sets (presents) the information about the site's identity and connection
  274. // in the |ui_|.
  275. void PresentSiteIdentity();
  276. // Presents feature related info in the |ui_|; like, if VR content is being
  277. // presented in a headset.
  278. void PresentPageFeatureInfo();
  279. // Sets (presents) the information about ad personalization in the |ui_|.
  280. void PresentAdPersonalizationData();
  281. #if BUILDFLAG(FULL_SAFE_BROWSING)
  282. // Records a password reuse event. If FULL_SAFE_BROWSING is defined, this
  283. // function WILL record an event. Callers should check conditions beforehand.
  284. void RecordPasswordReuseEvent();
  285. #endif
  286. // Helper function to get the |HostContentSettingsMap| associated with
  287. // |PageInfo|.
  288. HostContentSettingsMap* GetContentSettings() const;
  289. // Helper function to get the Safe Browsing status and details by malicious
  290. // content status.
  291. // TODO(jdeblasio): Eliminate this and just use MaliciousContentStatus?
  292. void GetSafeBrowsingStatusByMaliciousContentStatus(
  293. security_state::MaliciousContentStatus malicious_content_status,
  294. PageInfo::SafeBrowsingStatus* status,
  295. std::u16string* details);
  296. // Returns PageSpecificContentSettings for the observed WebContents if
  297. // present, nullptr otherwise.
  298. content_settings::PageSpecificContentSettings*
  299. GetPageSpecificContentSettings() const;
  300. // Whether the content setting of type |type| has changed via Page Info UI.
  301. bool HasContentSettingChangedViaPageInfo(ContentSettingsType type);
  302. // Notifies the delegate that the content setting of type |type| has changed
  303. // via Page Info UI.
  304. void ContentSettingChangedViaPageInfo(ContentSettingsType type);
  305. // Get counts of allowed and blocked cookies.
  306. int GetFirstPartyAllowedCookiesCount(const GURL& site_url);
  307. int GetFirstPartyBlockedCookiesCount(const GURL& site_url);
  308. int GetThirdPartyAllowedCookiesCount(const GURL& site_url);
  309. int GetThirdPartyBlockedCookiesCount(const GURL& site_url);
  310. // Get the count of blocked and allowed sites.
  311. int GetSitesWithAllowedCookiesAccessCount();
  312. int GetThirdPartySitesWithBlockedCookiesAccessCount(const GURL& site_url);
  313. // The page info UI displays information and controls for site-
  314. // specific data (local stored objects like cookies), site-specific
  315. // permissions (location, pop-up, plugin, etc. permissions) and site-specific
  316. // information (identity, connection status, etc.).
  317. raw_ptr<PageInfoUI> ui_;
  318. // A web contents getter used to retrieve the associated WebContents object.
  319. base::WeakPtr<content::WebContents> web_contents_;
  320. // The delegate allows the embedder to customize |PageInfo|'s behavior.
  321. std::unique_ptr<PageInfoDelegate> delegate_;
  322. // The flag that controls whether an infobar is displayed after the website
  323. // settings UI is closed or not.
  324. bool show_info_bar_;
  325. // The Omnibox URL of the website for which to display site permissions and
  326. // site information.
  327. GURL site_url_;
  328. // Status of the website's identity verification check.
  329. SiteIdentityStatus site_identity_status_;
  330. // Safe Browsing status of the website.
  331. SafeBrowsingStatus safe_browsing_status_;
  332. // Safety tip info of the website. Set regardless of whether the feature is
  333. // enabled to show the UI.
  334. security_state::SafetyTipInfo safety_tip_info_;
  335. // For secure connection |certificate_| is set to the server certificate.
  336. scoped_refptr<net::X509Certificate> certificate_;
  337. // Status of the connection to the website.
  338. SiteConnectionStatus site_connection_status_;
  339. // TODO(markusheintz): Move the creation of all the std::u16string typed UI
  340. // strings below to the corresponding UI code, in order to prevent
  341. // unnecessary UTF-8 string conversions.
  342. #if BUILDFLAG(IS_ANDROID)
  343. // Details about the website's identity. If the website's identity has been
  344. // verified then |identity_status_description_android_| contains who verified
  345. // the identity. This string will be displayed in the UI.
  346. std::u16string identity_status_description_android_;
  347. #endif
  348. // Set when the user has explicitly bypassed an SSL error for this host or
  349. // explicitly denied it (the latter of which is not currently possible in the
  350. // Chrome UI). When |show_ssl_decision_revoke_button| is true, the connection
  351. // area of the page info will include an option for the user to revoke their
  352. // decision to bypass the SSL error for this host.
  353. bool show_ssl_decision_revoke_button_;
  354. // Details about the connection to the website. In case of an encrypted
  355. // connection |site_connection_details_| contains encryption details, like
  356. // encryption strength and ssl protocol version. This string will be
  357. // displayed in the UI.
  358. std::u16string site_connection_details_;
  359. // For websites that provided an EV certificate |orgainization_name_|
  360. // contains the organization name of the certificate. In all other cases
  361. // |organization_name| is an empty string. This string will be displayed in
  362. // the UI.
  363. std::u16string organization_name_;
  364. bool did_revoke_user_ssl_decisions_;
  365. security_state::SecurityLevel security_level_;
  366. security_state::VisibleSecurityState visible_security_state_for_metrics_;
  367. // Set when the user ignored the password reuse modal warning dialog. When
  368. // |show_change_password_buttons_| is true, the page identity area of the page
  369. // info will include buttons to change corresponding password, and to
  370. // whitelist current site.
  371. bool show_change_password_buttons_;
  372. // The time the Page Info UI is opened, for measuring total time open.
  373. base::TimeTicks start_time_;
  374. // Records whether the user interacted with the bubble beyond opening it.
  375. bool did_perform_action_;
  376. // Description of the Safe Browsing status. Non-empty if
  377. // MaliciousContentStatus isn't NONE.
  378. std::u16string safe_browsing_details_;
  379. // Whether the "About this site" data was available for the site and "About
  380. // this site" section was shown in the page info.
  381. bool was_about_this_site_shown_ = false;
  382. std::u16string site_name_for_testing_;
  383. base::WeakPtrFactory<PageInfo> weak_factory_{this};
  384. };
  385. #endif // COMPONENTS_PAGE_INFO_PAGE_INFO_H_