| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 64 #include "core/timing/Performance.h" | 64 #include "core/timing/Performance.h" |
| 65 #include "platform/Logging.h" | 65 #include "platform/Logging.h" |
| 66 #include "platform/TracedValue.h" | 66 #include "platform/TracedValue.h" |
| 67 #include "platform/mhtml/MHTMLArchive.h" | 67 #include "platform/mhtml/MHTMLArchive.h" |
| 68 #include "platform/network/ResourceLoadPriority.h" | 68 #include "platform/network/ResourceLoadPriority.h" |
| 69 #include "platform/network/ResourceTimingInfo.h" | 69 #include "platform/network/ResourceTimingInfo.h" |
| 70 #include "platform/weborigin/SchemeRegistry.h" | 70 #include "platform/weborigin/SchemeRegistry.h" |
| 71 #include "platform/weborigin/SecurityPolicy.h" | 71 #include "platform/weborigin/SecurityPolicy.h" |
| 72 #include "public/platform/WebCachePolicy.h" | 72 #include "public/platform/WebCachePolicy.h" |
| 73 #include "public/platform/WebFrameScheduler.h" | 73 #include "public/platform/WebFrameScheduler.h" |
| 74 #include "public/platform/WebInsecureRequestPolicy.h" |
| 74 | 75 |
| 75 #include <algorithm> | 76 #include <algorithm> |
| 76 | 77 |
| 77 namespace blink { | 78 namespace blink { |
| 78 | 79 |
| 79 namespace { | 80 namespace { |
| 80 | 81 |
| 81 bool shouldDisallowFetchForMainFrameScript(const ResourceRequest& request, Fetch
Request::DeferOption defer, const Document& document) | 82 bool shouldDisallowFetchForMainFrameScript(const ResourceRequest& request, Fetch
Request::DeferOption defer, const Document& document) |
| 82 { | 83 { |
| 83 // Only scripts inserted via document.write are candidates for having their | 84 // Only scripts inserted via document.write are candidates for having their |
| (...skipping 562 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 646 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) | 647 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) |
| 647 { | 648 { |
| 648 KURL url = fetchRequest.resourceRequest().url(); | 649 KURL url = fetchRequest.resourceRequest().url(); |
| 649 | 650 |
| 650 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in | 651 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in |
| 651 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect | 652 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect |
| 652 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) | 653 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) |
| 653 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); | 654 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); |
| 654 | 655 |
| 655 // If we don't yet have an |m_document| (because we're loading an iframe, fo
r instance), check the FrameLoader's policy. | 656 // If we don't yet have an |m_document| (because we're loading an iframe, fo
r instance), check the FrameLoader's policy. |
| 656 SecurityContext::InsecureRequestsPolicy relevantPolicy = m_document ? m_docu
ment->getInsecureRequestsPolicy() : frame()->loader().getInsecureRequestsPolicy(
); | 657 WebInsecureRequestPolicy relevantPolicy = m_document ? m_document->getInsecu
reRequestPolicy() : frame()->loader().getInsecureRequestPolicy(); |
| 657 SecurityContext::InsecureNavigationsSet* relevantNavigationSet = m_document
? m_document->insecureNavigationsToUpgrade() : frame()->loader().insecureNavigat
ionsToUpgrade(); | 658 SecurityContext::InsecureNavigationsSet* relevantNavigationSet = m_document
? m_document->insecureNavigationsToUpgrade() : frame()->loader().insecureNavigat
ionsToUpgrade(); |
| 658 | 659 |
| 659 if (url.protocolIs("http") && relevantPolicy == SecurityContext::InsecureReq
uestsUpgrade) { | 660 if (url.protocolIs("http") && relevantPolicy & kUpgradeInsecureRequests) { |
| 660 // We always upgrade requests that meet any of the following criteria: | 661 // We always upgrade requests that meet any of the following criteria: |
| 661 // | 662 // |
| 662 // 1. Are for subresources (including nested frames). | 663 // 1. Are for subresources (including nested frames). |
| 663 // 2. Are form submissions. | 664 // 2. Are form submissions. |
| 664 // 3. Whose hosts are contained in the document's InsecureNavigationSet. | 665 // 3. Whose hosts are contained in the document's InsecureNavigationSet. |
| 665 const ResourceRequest& request = fetchRequest.resourceRequest(); | 666 const ResourceRequest& request = fetchRequest.resourceRequest(); |
| 666 if (request.frameType() == WebURLRequest::FrameTypeNone | 667 if (request.frameType() == WebURLRequest::FrameTypeNone |
| 667 || request.frameType() == WebURLRequest::FrameTypeNested | 668 || request.frameType() == WebURLRequest::FrameTypeNested |
| 668 || request.requestContext() == WebURLRequest::RequestContextForm | 669 || request.requestContext() == WebURLRequest::RequestContextForm |
| 669 || (!url.host().isNull() && relevantNavigationSet->contains(url.host
().impl()->hash()))) | 670 || (!url.host().isNull() && relevantNavigationSet->contains(url.host
().impl()->hash()))) |
| (...skipping 87 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 757 } | 758 } |
| 758 | 759 |
| 759 DEFINE_TRACE(FrameFetchContext) | 760 DEFINE_TRACE(FrameFetchContext) |
| 760 { | 761 { |
| 761 visitor->trace(m_document); | 762 visitor->trace(m_document); |
| 762 visitor->trace(m_documentLoader); | 763 visitor->trace(m_documentLoader); |
| 763 FetchContext::trace(visitor); | 764 FetchContext::trace(visitor); |
| 764 } | 765 } |
| 765 | 766 |
| 766 } // namespace blink | 767 } // namespace blink |
| OLD | NEW |