Fix bug where --allow-running-insecure-content flag doesn't work against google.com sites in stab...

chrome/renderer/chrome_render_view_observer.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_view_observer.h"
 
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/string_util.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/common/chrome_version_info.h"
 #include "chrome/common/icon_messages.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/thumbnail_score.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/renderer/about_handler.h"
 #include "chrome/renderer/automation/dom_automation_controller.h"
 #include "chrome/renderer/content_settings_observer.h"
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 #include "chrome/renderer/external_host_bindings.h"
 #include "chrome/renderer/frame_sniffer.h"
@@ skipping 55 matching lines @@
 // maximum number of characters in the document to index, any text beyond this
 // point will be clipped
 static const size_t kMaxIndexChars = 65535;
 
 // Size of the thumbnails that we'll generate
 static const int kThumbnailWidth = 212;
 static const int kThumbnailHeight = 132;
 
 // Constants for UMA statistic collection.
 static const char kSSLInsecureContent[] = "SSL.InsecureContent";
-static const char kDotGoogleDotCom[] = ".google.com";
 static const char kWWWDotGoogleDotCom[] = "www.google.com";
 static const char kMailDotGoogleDotCom[] = "mail.google.com";
 static const char kPlusDotGoogleDotCom[] = "plus.google.com";
 static const char kDocsDotGoogleDotCom[] = "docs.google.com";
 static const char kSitesDotGoogleDotCom[] = "sites.google.com";
 static const char kPicasawebDotGoogleDotCom[] = "picasaweb.google.com";
 static const char kCodeDotGoogleDotCom[] = "code.google.com";
 static const char kGroupsDotGoogleDotCom[] = "groups.google.com";
 static const char kMapsDotGoogleDotCom[] = "maps.google.com";
 static const char kWWWDotYoutubeDotCom[] = "www.youtube.com";
@@ skipping 38 matching lines @@
   INSECURE_CONTENT_RUN_HOST_GROUPS_GOOGLE,
   INSECURE_CONTENT_DISPLAY_HOST_MAPS_GOOGLE,
   INSECURE_CONTENT_RUN_HOST_MAPS_GOOGLE,
   INSECURE_CONTENT_DISPLAY_HOST_GOOGLE_SUPPORT,
   INSECURE_CONTENT_RUN_HOST_GOOGLE_SUPPORT,
   INSECURE_CONTENT_DISPLAY_HOST_GOOGLE_INTL,
   INSECURE_CONTENT_RUN_HOST_GOOGLE_INTL,
   INSECURE_CONTENT_NUM_EVENTS
 };
 
+// Constants for mixed-content blocking.
+static const char kGoogleDotCom[] = "google.com";
+static const char kFacebookDotCom[] = "facebook.com";

[scarybeasts, 2011/10/04 01:30:30]

Nit: recommend alphabetical order.

+static const char kTwitterDotCom[] = "twitter.com";
+
 static bool PaintViewIntoCanvas(WebView* view,
                                 skia::PlatformCanvas& canvas) {
   view->layout();
   const WebSize& size = view->size();
 
   if (!canvas.initialize(size.width, size.height, true))
     return false;
 
   view->paint(webkit_glue::ToWebCanvas(&canvas),
               WebRect(0, 0, size.width, size.height));
@@ skipping 23 matching lines @@
     case WebIconURL::TypeTouch:
       return FaviconURL::TOUCH_ICON;
     case WebIconURL::TypeTouchPrecomposed:
       return FaviconURL::TOUCH_PRECOMPOSED_ICON;
     case WebIconURL::TypeInvalid:
       return FaviconURL::INVALID_ICON;
   }
   return FaviconURL::INVALID_ICON;
 }
 
+static bool isHostInDomain(const std::string& host, const std::string& domain) {
+  return (EndsWith(host, domain, false) &&
+          (host.length() == domain.length() ||
+           (host.length() > domain.length() &&
+            host[host.length() - domain.length() - 1] == '.')));
+}
+
 namespace {
 GURL StripRef(const GURL& url) {
   GURL::Replacements replacements;
   replacements.ClearRef();
   return url.ReplaceComponents(replacements);
 }
 }  // namespace
 
 ChromeRenderViewObserver::ChromeRenderViewObserver(
     RenderView* render_view,
@@ skipping 223 matching lines @@
 bool ChromeRenderViewObserver::allowDisplayingInsecureContent(
     WebKit::WebFrame* frame,
     bool allowed_per_settings,
     const WebKit::WebSecurityOrigin& origin,
     const WebKit::WebURL& url) {
   UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                             INSECURE_CONTENT_DISPLAY,
                             INSECURE_CONTENT_NUM_EVENTS);
   std::string host(origin.host().utf8());
   GURL frame_url(frame->document().url());
-  if (EndsWith(host, kDotGoogleDotCom, false)) {
+  if (isHostInDomain(host, kGoogleDotCom)) {
     UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                               INSECURE_CONTENT_DISPLAY_HOST_GOOGLE,
                               INSECURE_CONTENT_NUM_EVENTS);
     if (StartsWithASCII(frame_url.path(), kGoogleSupportPathPrefix, false)) {
       UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                                 INSECURE_CONTENT_DISPLAY_HOST_GOOGLE_SUPPORT,
                                 INSECURE_CONTENT_NUM_EVENTS);
     } else if (StartsWithASCII(frame_url.path(),
                                kGoogleIntlPathPrefix,
                                false)) {
@@ skipping 65 matching lines @@
 bool ChromeRenderViewObserver::allowRunningInsecureContent(
     WebKit::WebFrame* frame,
     bool allowed_per_settings,
     const WebKit::WebSecurityOrigin& origin,
     const WebKit::WebURL& url) {
   UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                             INSECURE_CONTENT_RUN,
                             INSECURE_CONTENT_NUM_EVENTS);
   std::string host(origin.host().utf8());
   GURL frame_url(frame->document().url());
-  if (EndsWith(host, kDotGoogleDotCom, false)) {
+  bool is_google = isHostInDomain(host, kGoogleDotCom);
+  if (is_google) {
     UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                               INSECURE_CONTENT_RUN_HOST_GOOGLE,
                               INSECURE_CONTENT_NUM_EVENTS);
     if (StartsWithASCII(frame_url.path(), kGoogleSupportPathPrefix, false)) {
       UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                                 INSECURE_CONTENT_RUN_HOST_GOOGLE_SUPPORT,
                                 INSECURE_CONTENT_NUM_EVENTS);
     } else if (StartsWithASCII(frame_url.path(),
                                kGoogleIntlPathPrefix,
                                false)) {
@@ skipping 65 matching lines @@
   } else if (EndsWith(gurl.path(), kDotCSS, false)) {
     UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                               INSECURE_CONTENT_RUN_CSS,
                               INSECURE_CONTENT_NUM_EVENTS);
   } else if (EndsWith(gurl.path(), kDotSWF, false)) {
     UMA_HISTOGRAM_ENUMERATION(kSSLInsecureContent,
                               INSECURE_CONTENT_RUN_SWF,
                               INSECURE_CONTENT_NUM_EVENTS);
   }
 
-  if (allowed_per_settings || allow_running_insecure_content_)
+  if (allow_running_insecure_content_ || allowed_per_settings)
     return true;
 
+  bool enforce_insecure_content_on_all_domains =
+      (chrome::VersionInfo::GetChannel() != chrome::VersionInfo::CHANNEL_STABLE
+       || CommandLine::ForCurrentProcess()->HasSwitch(
+           switches::kNoRunningInsecureContent));
+
+  if (!enforce_insecure_content_on_all_domains) {
+    bool mandatory_enforcement = (is_google ||
+                                  isHostInDomain(host, kFacebookDotCom) ||
+                                  isHostInDomain(host, kTwitterDotCom));
+    if (!mandatory_enforcement)
+      return true;
+  }
+
   Send(new ChromeViewHostMsg_DidBlockRunningInsecureContent(routing_id()));
   return false;
 }
 
 void ChromeRenderViewObserver::didNotAllowPlugins(WebFrame* frame) {
   content_settings_->DidNotAllowPlugins(frame);
 }
 
 void ChromeRenderViewObserver::didNotAllowScript(WebFrame* frame) {
   content_settings_->DidNotAllowScript(frame);
@@ skipping 384 matching lines @@
     // Decode the favicon using WebKit's image decoder.
     webkit_glue::ImageDecoder decoder(
         gfx::Size(gfx::kFaviconSize, gfx::kFaviconSize));
     const unsigned char* src_data =
         reinterpret_cast<const unsigned char*>(&data[0]);
 
     return decoder.Decode(src_data, data.size());
   }
   return SkBitmap();
 }