Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1438)

Unified Diff: Source/modules/websockets/MainThreadWebSocketChannel.cpp

Issue 222153002: Disallow connecting an insecure WebSocket from a secure page. (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Rebase Created 6 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: Source/modules/websockets/MainThreadWebSocketChannel.cpp
diff --git a/Source/modules/websockets/MainThreadWebSocketChannel.cpp b/Source/modules/websockets/MainThreadWebSocketChannel.cpp
index e2318a145693cd3934b082ba7ac5e27ad51e2878..fc497da6bace1e7a2bbe498152a5eea25f9adadd 100644
--- a/Source/modules/websockets/MainThreadWebSocketChannel.cpp
+++ b/Source/modules/websockets/MainThreadWebSocketChannel.cpp
@@ -40,6 +40,7 @@
#include "core/inspector/InspectorInstrumentation.h"
#include "core/loader/FrameLoader.h"
#include "core/loader/FrameLoaderClient.h"
+#include "core/loader/MixedContentChecker.h"
#include "core/loader/UniqueIdentifier.h"
#include "core/page/Page.h"
#include "modules/websockets/WebSocketChannelClient.h"
@@ -87,11 +88,19 @@ MainThreadWebSocketChannel::~MainThreadWebSocketChannel()
{
}
-void MainThreadWebSocketChannel::connect(const KURL& url, const String& protocol)
+bool MainThreadWebSocketChannel::connect(const KURL& url, const String& protocol)
{
WTF_LOG(Network, "MainThreadWebSocketChannel %p connect()", this);
ASSERT(!m_handle);
ASSERT(!m_suspended);
+
+ if (m_document->frame() && !m_document->frame()->loader().mixedContentChecker()->canConnectInsecureWebSocket(m_document->securityOrigin(), url))
+ return false;
+ if (MixedContentChecker::isMixedContent(m_document->securityOrigin(), url)) {
+ String message = "Connecting to a non-secure WebSocket server from a secure origin is deprecated.";
+ m_document->addConsoleMessage(JSMessageSource, WarningMessageLevel, message);
+ }
+
m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document));
m_handshake->reset();
m_handshake->addExtensionProcessor(m_perMessageDeflate.createExtensionProcessor());
@@ -100,6 +109,7 @@ void MainThreadWebSocketChannel::connect(const KURL& url, const String& protocol
InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, protocol);
ref();
m_handle = SocketStreamHandle::create(m_handshake->url(), this);
+ return true;
}
String MainThreadWebSocketChannel::subprotocol()
« no previous file with comments | « Source/modules/websockets/MainThreadWebSocketChannel.h ('k') | Source/modules/websockets/NewWebSocketChannelImpl.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698