// Copyright 2015 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "components/ssl_errors/error_info.h"

#include <stddef.h>

#include <array>

#include "base/i18n/message_formatter.h"
#include "base/notreached.h"
#include "base/strings/escape.h"
#include "base/strings/utf_string_conversions.h"
#include "components/strings/grit/components_strings.h"
#include "net/base/features.h"
#include "net/base/net_errors.h"
#include "net/cert/cert_status_flags.h"
#include "net/ssl/ssl_info.h"
#include "ui/base/l10n/l10n_util.h"
#include "url/gurl.h"

using base::UTF8ToUTF16;

namespace ssl_errors {

ErrorInfo::ErrorInfo(const std::u16string& details,
                     const std::u16string& short_description)
    : details_(details), short_description_(short_description) {}

// static
ErrorInfo ErrorInfo::CreateError(ErrorType error_type,
                                 net::X509Certificate* cert,
                                 const GURL& request_url) {
  std::u16string details, short_description;
  switch (error_type) {
    case CERT_COMMON_NAME_INVALID: {
      std::vector<std::string> dns_names;
      cert->GetSubjectAltName(&dns_names, nullptr);

      size_t i = 0;
      if (dns_names.empty()) {
        // The certificate had no DNS names, display an explanatory string.
        details = l10n_util::GetStringFUTF16(
            IDS_CERT_ERROR_NO_SUBJECT_ALTERNATIVE_NAMES_DETAILS,
            UTF8ToUTF16(request_url.GetHost()));
      } else {
        // If the certificate contains multiple DNS names, we choose the most
        // representative one -- either the DNS name that's also in the subject
        // field, or the first one. If this heuristic turns out to be
        // inadequate, we can consider choosing the DNS name that is the
        // "closest match" to the host name in the request URL, or listing all
        // the DNS names with an HTML <ul>.
        for (; i < dns_names.size(); ++i) {
          if (dns_names[i] == cert->subject().common_name)
            break;
        }
        if (i == dns_names.size())
          i = 0;

        details = l10n_util::GetStringFUTF16(
            IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS,
            UTF8ToUTF16(request_url.GetHost()),
            base::EscapeForHTML(UTF8ToUTF16(dns_names[i])));
      }

      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION);
      break;
    }
    case CERT_DATE_INVALID:
      if (cert->HasExpired()) {
        // Make sure to round up to the smallest integer value not less than
        // the expiration value (https://crbug.com/476758).
        int expiration_value =
            (base::Time::Now() - cert->valid_expiry()).InDays() + 1;
        details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
            l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DETAILS),
            request_url.GetHost(), expiration_value, base::Time::Now());
        short_description =
            l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DESCRIPTION);
      } else if (base::Time::Now() < cert->valid_start()) {
        details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
            l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DETAILS),
            request_url.GetHost(),
            (cert->valid_start() - base::Time::Now()).InDays());
        short_description =
            l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DESCRIPTION);
      } else {
        // Two possibilities: (1) an intermediate or root certificate has
        // expired, or (2) the certificate has become valid since the error
        // occurred. Both are probably rare cases. To avoid giving the wrong
        // date, remove the information.
        details = l10n_util::GetStringFUTF16(
            IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DETAILS,
            UTF8ToUTF16(request_url.GetHost()));
        short_description = l10n_util::GetStringUTF16(
            IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DESCRIPTION);
      }
      break;
    case CERT_KNOWN_INTERCEPTION_BLOCKED:
    case CERT_AUTHORITY_INVALID:
    case CERT_SELF_SIGNED_LOCAL_NETWORK:
      details = l10n_util::GetStringFUTF16(
#if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED)
          base::FeatureList::IsEnabled(net::features::kVerifyQWACs)
              ? IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS_V2
              : IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS
#else
          IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS
#endif
          ,
          UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_AUTHORITY_INVALID_DESCRIPTION);
      break;
    case CERT_CONTAINS_ERRORS:
      details =
          l10n_util::GetStringFUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DETAILS,
                                     UTF8ToUTF16(request_url.GetHost()));
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DESCRIPTION);
      break;
    case CERT_NO_REVOCATION_MECHANISM:
      details = l10n_util::GetStringFUTF16(
          IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DETAILS,
          UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DESCRIPTION);
      break;
    case CERT_REVOKED:
      details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_REVOKED_CERT_DETAILS,
                                           UTF8ToUTF16(request_url.GetHost()));
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_DESCRIPTION);
      break;
    case CERT_INVALID:
      details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_INVALID_CERT_DETAILS,
                                           UTF8ToUTF16(request_url.GetHost()));
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_DESCRIPTION);
      break;
    case CERT_WEAK_SIGNATURE_ALGORITHM:
      details = l10n_util::GetStringFUTF16(
          IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DETAILS,
          UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DESCRIPTION);
      break;
    case CERT_WEAK_KEY:
      details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_WEAK_KEY_DETAILS,
                                           UTF8ToUTF16(request_url.GetHost()));
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION);
      break;
    case CERT_NAME_CONSTRAINT_VIOLATION:
      details = l10n_util::GetStringFUTF16(
          IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DETAILS,
          UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DESCRIPTION);
      break;
    case CERT_VALIDITY_TOO_LONG:
      details =
          l10n_util::GetStringFUTF16(IDS_CERT_ERROR_VALIDITY_TOO_LONG_DETAILS,
                                     UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_VALIDITY_TOO_LONG_DESCRIPTION);
      break;
    case CERT_PINNED_KEY_MISSING:
      details = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DETAILS);
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DESCRIPTION);
      break;
    case CERT_UNABLE_TO_CHECK_REVOCATION:
      details = l10n_util::GetStringFUTF16(
          IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DETAILS,
          UTF8ToUTF16(request_url.GetHost()));
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DESCRIPTION);
      break;
    case CERTIFICATE_TRANSPARENCY_REQUIRED:
      details = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DETAILS);
      short_description = l10n_util::GetStringUTF16(
          IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DESCRIPTION);
      break;
    case CERT_NON_UNIQUE_NAME:
      details =
          l10n_util::GetStringFUTF16(IDS_CERT_ERROR_NON_UNIQUE_NAME_DETAILS,
                                     UTF8ToUTF16(request_url.GetHost()));
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_NON_UNIQUE_NAME_DESCRIPTION);
      break;
    case UNKNOWN:
      details = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DETAILS);
      short_description =
          l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DESCRIPTION);
      break;
    default:
      NOTREACHED();
  }
  return ErrorInfo(details, short_description);
}

ErrorInfo::~ErrorInfo() = default;

// static
ErrorInfo::ErrorType ErrorInfo::NetErrorToErrorType(int net_error) {
  switch (net_error) {
    case net::ERR_CERT_COMMON_NAME_INVALID:
      return CERT_COMMON_NAME_INVALID;
    case net::ERR_CERT_DATE_INVALID:
      return CERT_DATE_INVALID;
    case net::ERR_CERT_AUTHORITY_INVALID:
      return CERT_AUTHORITY_INVALID;
    case net::ERR_CERT_CONTAINS_ERRORS:
      return CERT_CONTAINS_ERRORS;
    case net::ERR_CERT_NO_REVOCATION_MECHANISM:
      return CERT_NO_REVOCATION_MECHANISM;
    case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
      return CERT_UNABLE_TO_CHECK_REVOCATION;
    case net::ERR_CERT_REVOKED:
      return CERT_REVOKED;
    case net::ERR_CERT_INVALID:
      return CERT_INVALID;
    case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
      return CERT_WEAK_SIGNATURE_ALGORITHM;
    case net::ERR_CERT_NON_UNIQUE_NAME:
      return CERT_NON_UNIQUE_NAME;
    case net::ERR_CERT_WEAK_KEY:
      return CERT_WEAK_KEY;
    case net::ERR_CERT_NAME_CONSTRAINT_VIOLATION:
      return CERT_NAME_CONSTRAINT_VIOLATION;
    case net::ERR_CERT_VALIDITY_TOO_LONG:
      return CERT_VALIDITY_TOO_LONG;
    case net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN:
      return CERT_PINNED_KEY_MISSING;
    case net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED:
      return CERTIFICATE_TRANSPARENCY_REQUIRED;
    case net::ERR_CERT_KNOWN_INTERCEPTION_BLOCKED:
      return CERT_KNOWN_INTERCEPTION_BLOCKED;
    case net::ERR_CERT_SELF_SIGNED_LOCAL_NETWORK:
      return CERT_SELF_SIGNED_LOCAL_NETWORK;
    default:
      NOTREACHED();
  }
}

// static
void ErrorInfo::GetErrorsForCertStatus(
    const scoped_refptr<net::X509Certificate>& cert,
    net::CertStatus cert_status,
    const GURL& url,
    std::vector<ErrorInfo>* errors) {
  const auto kErrorFlags = std::to_array<net::CertStatus>({
      net::CERT_STATUS_COMMON_NAME_INVALID,
      net::CERT_STATUS_DATE_INVALID,
      net::CERT_STATUS_AUTHORITY_INVALID,
      net::CERT_STATUS_NO_REVOCATION_MECHANISM,
      net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION,
      net::CERT_STATUS_REVOKED,
      net::CERT_STATUS_INVALID,
      net::CERT_STATUS_WEAK_SIGNATURE_ALGORITHM,
      net::CERT_STATUS_NON_UNIQUE_NAME,
      net::CERT_STATUS_WEAK_KEY,
      net::CERT_STATUS_NAME_CONSTRAINT_VIOLATION,
      net::CERT_STATUS_VALIDITY_TOO_LONG,
      net::CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED,
      net::CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED,
  });

  const auto kErrorTypes = std::to_array<ErrorType>({
      CERT_COMMON_NAME_INVALID,
      CERT_DATE_INVALID,
      CERT_AUTHORITY_INVALID,
      CERT_NO_REVOCATION_MECHANISM,
      CERT_UNABLE_TO_CHECK_REVOCATION,
      CERT_REVOKED,
      CERT_INVALID,
      CERT_WEAK_SIGNATURE_ALGORITHM,
      CERT_NON_UNIQUE_NAME,
      CERT_WEAK_KEY,
      CERT_NAME_CONSTRAINT_VIOLATION,
      CERT_VALIDITY_TOO_LONG,
      CERTIFICATE_TRANSPARENCY_REQUIRED,
      CERT_KNOWN_INTERCEPTION_BLOCKED,
  });
  DCHECK(std::size(kErrorFlags) == std::size(kErrorTypes));

  for (size_t i = 0; i < std::size(kErrorFlags); ++i) {
    if ((cert_status & kErrorFlags[i]) && errors) {
      errors->push_back(
          ErrorInfo::CreateError(kErrorTypes[i], cert.get(), url));
    }
  }
}

}  // namespace ssl_errors