| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2012 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * | 7 * |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 10 matching lines...) Expand all Loading... |
| 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
| 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND | 23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
| 24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 27 */ | 27 */ |
| 28 | 28 |
| 29 #include "core/loader/MixedContentChecker.h" | 29 #include "core/loader/MixedContentChecker.h" |
| 30 | 30 |
| 31 #include "bindings/core/v8/SourceLocation.h" |
| 31 #include "core/dom/Document.h" | 32 #include "core/dom/Document.h" |
| 32 #include "core/frame/Frame.h" | 33 #include "core/frame/Frame.h" |
| 33 #include "core/frame/LocalFrame.h" | 34 #include "core/frame/LocalFrame.h" |
| 34 #include "core/frame/Settings.h" | 35 #include "core/frame/Settings.h" |
| 35 #include "core/frame/UseCounter.h" | 36 #include "core/frame/UseCounter.h" |
| 36 #include "core/inspector/ConsoleMessage.h" | 37 #include "core/inspector/ConsoleMessage.h" |
| 37 #include "core/loader/DocumentLoader.h" | 38 #include "core/loader/DocumentLoader.h" |
| 38 #include "core/loader/FrameLoader.h" | 39 #include "core/loader/FrameLoader.h" |
| 39 #include "core/loader/FrameLoaderClient.h" | 40 #include "core/loader/FrameLoaderClient.h" |
| 40 #include "platform/RuntimeEnabledFeatures.h" | 41 #include "platform/RuntimeEnabledFeatures.h" |
| (...skipping 208 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 249 } | 250 } |
| 250 | 251 |
| 251 // static | 252 // static |
| 252 void MixedContentChecker::logToConsoleAboutFetch(LocalFrame* frame, const KURL&
mainResourceUrl, const KURL& url, WebURLRequest::RequestContext requestContext,
bool allowed) | 253 void MixedContentChecker::logToConsoleAboutFetch(LocalFrame* frame, const KURL&
mainResourceUrl, const KURL& url, WebURLRequest::RequestContext requestContext,
bool allowed) |
| 253 { | 254 { |
| 254 String message = String::format( | 255 String message = String::format( |
| 255 "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an
insecure %s '%s'. %s", | 256 "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an
insecure %s '%s'. %s", |
| 256 mainResourceUrl.elidedString().utf8().data(), typeNameFromContext(reques
tContext), url.elidedString().utf8().data(), | 257 mainResourceUrl.elidedString().utf8().data(), typeNameFromContext(reques
tContext), url.elidedString().utf8().data(), |
| 257 allowed ? "This content should also be served over HTTPS." : "This reque
st has been blocked; the content must be served over HTTPS."); | 258 allowed ? "This content should also be served over HTTPS." : "This reque
st has been blocked; the content must be served over HTTPS."); |
| 258 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; | 259 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; |
| 259 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message)); | 260 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message, SourceLocation::capture(frame->document()))); |
| 260 } | 261 } |
| 261 | 262 |
| 262 // static | 263 // static |
| 263 void MixedContentChecker::count(Frame* frame, WebURLRequest::RequestContext requ
estContext) | 264 void MixedContentChecker::count(Frame* frame, WebURLRequest::RequestContext requ
estContext) |
| 264 { | 265 { |
| 265 UseCounter::count(frame, UseCounter::MixedContentPresent); | 266 UseCounter::count(frame, UseCounter::MixedContentPresent); |
| 266 | 267 |
| 267 // Roll blockable content up into a single counter, count unblocked types in
dividually so we | 268 // Roll blockable content up into a single counter, count unblocked types in
dividually so we |
| 268 // can determine when they can be safely moved to the blockable category: | 269 // can determine when they can be safely moved to the blockable category: |
| 269 ContextType contextType = contextTypeFromContext(requestContext, frame); | 270 ContextType contextType = contextTypeFromContext(requestContext, frame); |
| (...skipping 118 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 388 } | 389 } |
| 389 | 390 |
| 390 // static | 391 // static |
| 391 void MixedContentChecker::logToConsoleAboutWebSocket(LocalFrame* frame, const KU
RL& mainResourceUrl, const KURL& url, bool allowed) | 392 void MixedContentChecker::logToConsoleAboutWebSocket(LocalFrame* frame, const KU
RL& mainResourceUrl, const KURL& url, bool allowed) |
| 392 { | 393 { |
| 393 String message = String::format( | 394 String message = String::format( |
| 394 "Mixed Content: The page at '%s' was loaded over HTTPS, but attempted to
connect to the insecure WebSocket endpoint '%s'. %s", | 395 "Mixed Content: The page at '%s' was loaded over HTTPS, but attempted to
connect to the insecure WebSocket endpoint '%s'. %s", |
| 395 mainResourceUrl.elidedString().utf8().data(), url.elidedString().utf8().
data(), | 396 mainResourceUrl.elidedString().utf8().data(), url.elidedString().utf8().
data(), |
| 396 allowed ? "This endpoint should be available via WSS. Insecure access is
deprecated." : "This request has been blocked; this endpoint must be available
over WSS."); | 397 allowed ? "This endpoint should be available via WSS. Insecure access is
deprecated." : "This request has been blocked; this endpoint must be available
over WSS."); |
| 397 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; | 398 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; |
| 398 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message)); | 399 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message, SourceLocation::capture(frame->document()))); |
| 399 } | 400 } |
| 400 | 401 |
| 401 // static | 402 // static |
| 402 bool MixedContentChecker::shouldBlockWebSocket(LocalFrame* frame, const KURL& ur
l, MixedContentChecker::ReportingStatus reportingStatus) | 403 bool MixedContentChecker::shouldBlockWebSocket(LocalFrame* frame, const KURL& ur
l, MixedContentChecker::ReportingStatus reportingStatus) |
| 403 { | 404 { |
| 404 Frame* mixedFrame = inWhichFrameIsContentMixed(frame, WebURLRequest::FrameTy
peNone, url); | 405 Frame* mixedFrame = inWhichFrameIsContentMixed(frame, WebURLRequest::FrameTy
peNone, url); |
| 405 if (!mixedFrame) | 406 if (!mixedFrame) |
| 406 return false; | 407 return false; |
| 407 | 408 |
| 408 UseCounter::count(mixedFrame, UseCounter::MixedContentPresent); | 409 UseCounter::count(mixedFrame, UseCounter::MixedContentPresent); |
| (...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 450 | 451 |
| 451 // Use the current local frame's client; the embedder doesn't | 452 // Use the current local frame's client; the embedder doesn't |
| 452 // distinguish mixed content signals from different frames on the | 453 // distinguish mixed content signals from different frames on the |
| 453 // same page. | 454 // same page. |
| 454 frame->loader().client()->didDisplayInsecureContent(); | 455 frame->loader().client()->didDisplayInsecureContent(); |
| 455 | 456 |
| 456 if (reportingStatus == SendReport) { | 457 if (reportingStatus == SendReport) { |
| 457 String message = String::format( | 458 String message = String::format( |
| 458 "Mixed Content: The page at '%s' was loaded over a secure connection
, but contains a form which targets an insecure endpoint '%s'. This endpoint sho
uld be made available over a secure connection.", | 459 "Mixed Content: The page at '%s' was loaded over a secure connection
, but contains a form which targets an insecure endpoint '%s'. This endpoint sho
uld be made available over a secure connection.", |
| 459 mainResourceUrlForFrame(mixedFrame).elidedString().utf8().data(), ur
l.elidedString().utf8().data()); | 460 mainResourceUrlForFrame(mixedFrame).elidedString().utf8().data(), ur
l.elidedString().utf8().data()); |
| 460 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMess
ageSource, WarningMessageLevel, message)); | 461 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMess
ageSource, WarningMessageLevel, message, SourceLocation::capture(frame->document
()))); |
| 461 } | 462 } |
| 462 | 463 |
| 463 return true; | 464 return true; |
| 464 } | 465 } |
| 465 | 466 |
| 466 void MixedContentChecker::checkMixedPrivatePublic(LocalFrame* frame, const Atomi
cString& resourceIPAddress) | 467 void MixedContentChecker::checkMixedPrivatePublic(LocalFrame* frame, const Atomi
cString& resourceIPAddress) |
| 467 { | 468 { |
| 468 if (!frame || !frame->document() || !frame->document()->loader()) | 469 if (!frame || !frame->document() || !frame->document()->loader()) |
| 469 return; | 470 return; |
| 470 | 471 |
| (...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 517 | 518 |
| 518 // See comment in shouldBlockFetch() about loading the main resource of a su
bframe. | 519 // See comment in shouldBlockFetch() about loading the main resource of a su
bframe. |
| 519 if (request.frameType() == WebURLRequest::FrameTypeNested && !SchemeRegistry
::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())) { | 520 if (request.frameType() == WebURLRequest::FrameTypeNested && !SchemeRegistry
::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())) { |
| 520 return ContextTypeOptionallyBlockable; | 521 return ContextTypeOptionallyBlockable; |
| 521 } | 522 } |
| 522 | 523 |
| 523 return contextTypeFromContext(request.requestContext(), mixedFrame); | 524 return contextTypeFromContext(request.requestContext(), mixedFrame); |
| 524 } | 525 } |
| 525 | 526 |
| 526 } // namespace blink | 527 } // namespace blink |
| OLD | NEW |