Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2293)

Unified Diff: Source/modules/websockets/NewWebSocketChannelImpl.cpp

Issue 222153002: Disallow connecting an insecure WebSocket from a secure page. (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Rebase Created 6 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « Source/modules/websockets/NewWebSocketChannelImpl.h ('k') | Source/modules/websockets/WebSocket.cpp » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/modules/websockets/NewWebSocketChannelImpl.cpp
diff --git a/Source/modules/websockets/NewWebSocketChannelImpl.cpp b/Source/modules/websockets/NewWebSocketChannelImpl.cpp
index 9a190b9b31890413b8d719532d9b15fd7b514a4d..4373adc575ffa7d23a8c32da06b48fcbff00d8d5 100644
--- a/Source/modules/websockets/NewWebSocketChannelImpl.cpp
+++ b/Source/modules/websockets/NewWebSocketChannelImpl.cpp
@@ -35,7 +35,10 @@
#include "core/dom/ExecutionContext.h"
#include "core/fileapi/FileReaderLoader.h"
#include "core/fileapi/FileReaderLoaderClient.h"
+#include "core/frame/LocalFrame.h"
#include "core/inspector/InspectorInstrumentation.h"
+#include "core/loader/FrameLoader.h"
+#include "core/loader/MixedContentChecker.h"
#include "core/loader/UniqueIdentifier.h"
#include "modules/websockets/WebSocketChannelClient.h"
#include "modules/websockets/WebSocketFrame.h"
@@ -119,11 +122,19 @@ NewWebSocketChannelImpl::~NewWebSocketChannelImpl()
abortAsyncOperations();
}
-void NewWebSocketChannelImpl::connect(const KURL& url, const String& protocol)
+bool NewWebSocketChannelImpl::connect(const KURL& url, const String& protocol)
{
WTF_LOG(Network, "NewWebSocketChannelImpl %p connect()", this);
if (!m_handle)
- return;
+ return false;
+
+ if (executionContext()->isDocument() && document()->frame() && !document()->frame()->loader().mixedContentChecker()->canConnectInsecureWebSocket(document()->securityOrigin(), url))
+ return false;
+ if (MixedContentChecker::isMixedContent(document()->securityOrigin(), url)) {
+ String message = "Connecting to a non-secure WebSocket server from a secure origin is deprecated.";
+ document()->addConsoleMessage(JSMessageSource, WarningMessageLevel, message);
+ }
+
m_url = url;
Vector<String> protocols;
// Avoid placing an empty token in the Vector when the protocol string is
@@ -141,6 +152,7 @@ void NewWebSocketChannelImpl::connect(const KURL& url, const String& protocol)
flowControlIfNecessary();
if (m_identifier)
InspectorInstrumentation::didCreateWebSocket(document(), m_identifier, url, protocol);
+ return true;
}
String NewWebSocketChannelImpl::subprotocol()
« no previous file with comments | « Source/modules/websockets/NewWebSocketChannelImpl.h ('k') | Source/modules/websockets/WebSocket.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698