Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(420)

Side by Side Diff: third_party/WebKit/Source/core/loader/MixedContentChecker.cpp

Issue 1773813007: blink: Rename modules/ method to prefix with get when they collide. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: clash-modules: rebase-fixes Created 4 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2012 Google Inc. All rights reserved. 2 * Copyright (C) 2012 Google Inc. All rights reserved.
3 * 3 *
4 * Redistribution and use in source and binary forms, with or without 4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions 5 * modification, are permitted provided that the following conditions
6 * are met: 6 * are met:
7 * 7 *
8 * 1. Redistributions of source code must retain the above copyright 8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer. 9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright 10 * 2. Redistributions in binary form must reproduce the above copyright
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after
48 48
49 namespace { 49 namespace {
50 50
51 // When a frame is local, use its full URL to represent the main 51 // When a frame is local, use its full URL to represent the main
52 // resource. When the frame is remote, the full URL isn't accessible, so 52 // resource. When the frame is remote, the full URL isn't accessible, so
53 // use the origin. This function is used, for example, to determine the 53 // use the origin. This function is used, for example, to determine the
54 // URL to show in console messages about mixed content. 54 // URL to show in console messages about mixed content.
55 KURL mainResourceUrlForFrame(Frame* frame) 55 KURL mainResourceUrlForFrame(Frame* frame)
56 { 56 {
57 if (frame->isRemoteFrame()) 57 if (frame->isRemoteFrame())
58 return KURL(KURL(), frame->securityContext()->securityOrigin()->toString ()); 58 return KURL(KURL(), frame->securityContext()->getSecurityOrigin()->toStr ing());
59 return toLocalFrame(frame)->document()->url(); 59 return toLocalFrame(frame)->document()->url();
60 } 60 }
61 61
62 } // namespace 62 } // namespace
63 63
64 static void measureStricterVersionOfIsMixedContent(Frame* frame, const KURL& url ) 64 static void measureStricterVersionOfIsMixedContent(Frame* frame, const KURL& url )
65 { 65 {
66 // We're currently only checking for mixed content in `https://*` contexts. 66 // We're currently only checking for mixed content in `https://*` contexts.
67 // What about other "secure" contexts the SchemeRegistry knows about? We'll 67 // What about other "secure" contexts the SchemeRegistry knows about? We'll
68 // use this method to measure the occurance of non-webby mixed content to 68 // use this method to measure the occurance of non-webby mixed content to
69 // make sure we're not breaking the world without realizing it. 69 // make sure we're not breaking the world without realizing it.
70 SecurityOrigin* origin = frame->securityContext()->securityOrigin(); 70 SecurityOrigin* origin = frame->securityContext()->getSecurityOrigin();
71 if (MixedContentChecker::isMixedContent(origin, url)) { 71 if (MixedContentChecker::isMixedContent(origin, url)) {
72 if (origin->protocol() != "https") 72 if (origin->protocol() != "https")
73 UseCounter::count(frame, UseCounter::MixedContentInNonHTTPSFrameThat RestrictsMixedContent); 73 UseCounter::count(frame, UseCounter::MixedContentInNonHTTPSFrameThat RestrictsMixedContent);
74 } else if (!SecurityOrigin::isSecure(url) && SchemeRegistry::shouldTreatURLS chemeAsSecure(origin->protocol())) { 74 } else if (!SecurityOrigin::isSecure(url) && SchemeRegistry::shouldTreatURLS chemeAsSecure(origin->protocol())) {
75 UseCounter::count(frame, UseCounter::MixedContentInSecureFrameThatDoesNo tRestrictMixedContent); 75 UseCounter::count(frame, UseCounter::MixedContentInSecureFrameThatDoesNo tRestrictMixedContent);
76 } 76 }
77 } 77 }
78 78
79 bool requestIsSubframeSubresource(Frame* frame, WebURLRequest::FrameType frameTy pe) 79 bool requestIsSubframeSubresource(Frame* frame, WebURLRequest::FrameType frameTy pe)
80 { 80 {
(...skipping 13 matching lines...) Expand all
94 // static 94 // static
95 Frame* MixedContentChecker::inWhichFrameIsContentMixed(Frame* frame, WebURLReque st::FrameType frameType, const KURL& url) 95 Frame* MixedContentChecker::inWhichFrameIsContentMixed(Frame* frame, WebURLReque st::FrameType frameType, const KURL& url)
96 { 96 {
97 // We only care about subresource loads; top-level navigations cannot be mix ed content. Neither can frameless requests. 97 // We only care about subresource loads; top-level navigations cannot be mix ed content. Neither can frameless requests.
98 if (frameType == WebURLRequest::FrameTypeTopLevel || !frame) 98 if (frameType == WebURLRequest::FrameTypeTopLevel || !frame)
99 return nullptr; 99 return nullptr;
100 100
101 // Check the top frame first. 101 // Check the top frame first.
102 if (Frame* top = frame->tree().top()) { 102 if (Frame* top = frame->tree().top()) {
103 measureStricterVersionOfIsMixedContent(top, url); 103 measureStricterVersionOfIsMixedContent(top, url);
104 if (isMixedContent(top->securityContext()->securityOrigin(), url)) 104 if (isMixedContent(top->securityContext()->getSecurityOrigin(), url))
105 return top; 105 return top;
106 } 106 }
107 107
108 measureStricterVersionOfIsMixedContent(frame, url); 108 measureStricterVersionOfIsMixedContent(frame, url);
109 if (isMixedContent(frame->securityContext()->securityOrigin(), url)) 109 if (isMixedContent(frame->securityContext()->getSecurityOrigin(), url))
110 return frame; 110 return frame;
111 111
112 // No mixed content, no problem. 112 // No mixed content, no problem.
113 return nullptr; 113 return nullptr;
114 } 114 }
115 115
116 // static 116 // static
117 MixedContentChecker::ContextType MixedContentChecker::contextTypeFromContext(Web URLRequest::RequestContext context, Frame* frame) 117 MixedContentChecker::ContextType MixedContentChecker::contextTypeFromContext(Web URLRequest::RequestContext context, Frame* frame)
118 { 118 {
119 switch (context) { 119 switch (context) {
(...skipping 194 matching lines...) Expand 10 before | Expand all | Expand 10 after
314 if (!mixedFrame) 314 if (!mixedFrame)
315 return false; 315 return false;
316 316
317 MixedContentChecker::count(mixedFrame, requestContext); 317 MixedContentChecker::count(mixedFrame, requestContext);
318 318
319 Settings* settings = mixedFrame->settings(); 319 Settings* settings = mixedFrame->settings();
320 // Use the current local frame's client; the embedder doesn't 320 // Use the current local frame's client; the embedder doesn't
321 // distinguish mixed content signals from different frames on the 321 // distinguish mixed content signals from different frames on the
322 // same page. 322 // same page.
323 FrameLoaderClient* client = frame->loader().client(); 323 FrameLoaderClient* client = frame->loader().client();
324 SecurityOrigin* securityOrigin = mixedFrame->securityContext()->securityOrig in(); 324 SecurityOrigin* securityOrigin = mixedFrame->securityContext()->getSecurityO rigin();
325 bool allowed = false; 325 bool allowed = false;
326 326
327 // If we're in strict mode, we'll automagically fail everything, and intenti onally skip 327 // If we're in strict mode, we'll automagically fail everything, and intenti onally skip
328 // the client checks in order to prevent degrading the site's security UI. 328 // the client checks in order to prevent degrading the site's security UI.
329 bool strictMode = mixedFrame->securityContext()->shouldEnforceStrictMixedCon tentChecking() || settings->strictMixedContentChecking(); 329 bool strictMode = mixedFrame->securityContext()->shouldEnforceStrictMixedCon tentChecking() || settings->strictMixedContentChecking();
330 330
331 ContextType contextType = contextTypeFromContext(requestContext, mixedFrame) ; 331 ContextType contextType = contextTypeFromContext(requestContext, mixedFrame) ;
332 332
333 // If we're loading the main resource of a subframe, we need to take a close look at the loaded URL. 333 // If we're loading the main resource of a subframe, we need to take a close look at the loaded URL.
334 // If we're dealing with a CORS-enabled scheme, then block mixed frames as a ctive content. Otherwise, 334 // If we're dealing with a CORS-enabled scheme, then block mixed frames as a ctive content. Otherwise,
(...skipping 13 matching lines...) Expand all
348 348
349 case ContextTypeBlockable: { 349 case ContextTypeBlockable: {
350 // Strictly block subresources that are mixed with respect to 350 // Strictly block subresources that are mixed with respect to
351 // their subframes, unless all insecure content is allowed. This 351 // their subframes, unless all insecure content is allowed. This
352 // is to avoid the following situation: https://a.com embeds 352 // is to avoid the following situation: https://a.com embeds
353 // https://b.com, which loads a script over insecure HTTP. The 353 // https://b.com, which loads a script over insecure HTTP. The
354 // user opts to allow the insecure content, thinking that they are 354 // user opts to allow the insecure content, thinking that they are
355 // allowing an insecure script to run on https://a.com and not 355 // allowing an insecure script to run on https://a.com and not
356 // realizing that they are in fact allowing an insecure script on 356 // realizing that they are in fact allowing an insecure script on
357 // https://b.com. 357 // https://b.com.
358 if (!settings->allowRunningOfInsecureContent() && requestIsSubframeSubre source(effectiveFrame, frameType) && isMixedContent(frame->securityContext()->se curityOrigin(), url)) { 358 if (!settings->allowRunningOfInsecureContent() && requestIsSubframeSubre source(effectiveFrame, frameType) && isMixedContent(frame->securityContext()->ge tSecurityOrigin(), url)) {
359 UseCounter::count(mixedFrame, UseCounter::BlockableMixedContentInSub frameBlocked); 359 UseCounter::count(mixedFrame, UseCounter::BlockableMixedContentInSub frameBlocked);
360 allowed = false; 360 allowed = false;
361 break; 361 break;
362 } 362 }
363 363
364 bool shouldAskEmbedder = !strictMode && settings && (!settings->strictly BlockBlockableMixedContent() || settings->allowRunningOfInsecureContent()); 364 bool shouldAskEmbedder = !strictMode && settings && (!settings->strictly BlockBlockableMixedContent() || settings->allowRunningOfInsecureContent());
365 allowed = shouldAskEmbedder && client->allowRunningInsecureContent(setti ngs && settings->allowRunningOfInsecureContent(), securityOrigin, url); 365 allowed = shouldAskEmbedder && client->allowRunningInsecureContent(setti ngs && settings->allowRunningOfInsecureContent(), securityOrigin, url);
366 if (allowed) { 366 if (allowed) {
367 client->didRunInsecureContent(securityOrigin, url); 367 client->didRunInsecureContent(securityOrigin, url);
368 UseCounter::count(mixedFrame, UseCounter::MixedContentBlockableAllow ed); 368 UseCounter::count(mixedFrame, UseCounter::MixedContentBlockableAllow ed);
(...skipping 35 matching lines...) Expand 10 before | Expand all | Expand 10 after
404 return false; 404 return false;
405 405
406 UseCounter::count(mixedFrame, UseCounter::MixedContentPresent); 406 UseCounter::count(mixedFrame, UseCounter::MixedContentPresent);
407 UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket); 407 UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket);
408 408
409 Settings* settings = mixedFrame->settings(); 409 Settings* settings = mixedFrame->settings();
410 // Use the current local frame's client; the embedder doesn't 410 // Use the current local frame's client; the embedder doesn't
411 // distinguish mixed content signals from different frames on the 411 // distinguish mixed content signals from different frames on the
412 // same page. 412 // same page.
413 FrameLoaderClient* client = frame->loader().client(); 413 FrameLoaderClient* client = frame->loader().client();
414 SecurityOrigin* securityOrigin = mixedFrame->securityContext()->securityOrig in(); 414 SecurityOrigin* securityOrigin = mixedFrame->securityContext()->getSecurityO rigin();
415 bool allowed = false; 415 bool allowed = false;
416 416
417 // If we're in strict mode, we'll automagically fail everything, and intenti onally skip 417 // If we're in strict mode, we'll automagically fail everything, and intenti onally skip
418 // the client checks in order to prevent degrading the site's security UI. 418 // the client checks in order to prevent degrading the site's security UI.
419 bool strictMode = mixedFrame->securityContext()->shouldEnforceStrictMixedCon tentChecking() || settings->strictMixedContentChecking(); 419 bool strictMode = mixedFrame->securityContext()->shouldEnforceStrictMixedCon tentChecking() || settings->strictMixedContentChecking();
420 if (!strictMode) { 420 if (!strictMode) {
421 bool allowedPerSettings = settings && settings->allowRunningOfInsecureCo ntent(); 421 bool allowedPerSettings = settings && settings->allowRunningOfInsecureCo ntent();
422 allowed = client->allowRunningInsecureContent(allowedPerSettings, securi tyOrigin, url); 422 allowed = client->allowRunningInsecureContent(allowedPerSettings, securi tyOrigin, url);
423 } 423 }
424 424
(...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after
519 519
520 // See comment in shouldBlockFetch() about loading the main resource of a su bframe. 520 // See comment in shouldBlockFetch() about loading the main resource of a su bframe.
521 if (request.frameType() == WebURLRequest::FrameTypeNested && !SchemeRegistry ::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())) { 521 if (request.frameType() == WebURLRequest::FrameTypeNested && !SchemeRegistry ::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())) {
522 return ContextTypeOptionallyBlockable; 522 return ContextTypeOptionallyBlockable;
523 } 523 }
524 524
525 return contextTypeFromContext(request.requestContext(), mixedFrame); 525 return contextTypeFromContext(request.requestContext(), mixedFrame);
526 } 526 }
527 527
528 } // namespace blink 528 } // namespace blink
OLDNEW
« no previous file with comments | « third_party/WebKit/Source/core/loader/LinkLoader.cpp ('k') | third_party/WebKit/Source/core/loader/NavigationScheduler.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698