[Presentation API] PresentationRequest should throw SecurityError for mixed contents

third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp

Index: third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
diff --git a/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp b/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
index 0305d72b55c1d5013eb950e9266a0cb0ae11f349..7c3ea60f0a36219f2d738d7295d82223625335f4 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp
@@ -13,6 +13,7 @@
 #include "core/dom/ExecutionContext.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
+#include "core/loader/MixedContentChecker.h"
 #include "modules/EventTargetModules.h"
 #include "modules/presentation/PresentationAvailability.h"
 #include "modules/presentation/PresentationAvailabilityCallbacks.h"
@@ -105,11 +106,12 @@ ScriptPromise PresentationRequest::start(ScriptState* scriptState) {
             InvalidAccessError,
             "PresentationRequest::start() requires user gesture."));
 
+  if (MixedContentChecker::isMixedContent(
+          getExecutionContext()->getSecurityOrigin(), m_url))
+    return rejectWithMixedContentException(scriptState);
+
   if (toDocument(getExecutionContext())->isSandboxed(SandboxPresentation))
-    return ScriptPromise::rejectWithDOMException(
-        scriptState, DOMException::create(SecurityError,
-                                          "The document is sandboxed and lacks "
-                                          "the 'allow-presentation' flag."));
+    return rejectWithSandBoxException(scriptState);
 
   WebPresentationClient* client = presentationClient(getExecutionContext());
   if (!client)
@@ -130,11 +132,12 @@ ScriptPromise PresentationRequest::start(ScriptState* scriptState) {
 
 ScriptPromise PresentationRequest::reconnect(ScriptState* scriptState,
                                              const String& id) {
+  if (MixedContentChecker::isMixedContent(
+          getExecutionContext()->getSecurityOrigin(), m_url))
+    return rejectWithMixedContentException(scriptState);
+
   if (toDocument(getExecutionContext())->isSandboxed(SandboxPresentation))
-    return ScriptPromise::rejectWithDOMException(
-        scriptState, DOMException::create(SecurityError,
-                                          "The document is sandboxed and lacks "
-                                          "the 'allow-presentation' flag."));
+    return rejectWithSandBoxException(scriptState);
 
   WebPresentationClient* client = presentationClient(getExecutionContext());
   if (!client)
@@ -154,11 +157,12 @@ ScriptPromise PresentationRequest::reconnect(ScriptState* scriptState,
 }
 
 ScriptPromise PresentationRequest::getAvailability(ScriptState* scriptState) {
+  if (MixedContentChecker::isMixedContent(
+          getExecutionContext()->getSecurityOrigin(), m_url))
+    return rejectWithMixedContentException(scriptState);
+
   if (toDocument(getExecutionContext())->isSandboxed(SandboxPresentation))
-    return ScriptPromise::rejectWithDOMException(
-        scriptState, DOMException::create(SecurityError,
-                                          "The document is sandboxed and lacks "
-                                          "the 'allow-presentation' flag."));
+    return rejectWithSandBoxException(scriptState);
 
   WebPresentationClient* client = presentationClient(getExecutionContext());
   if (!client)
@@ -189,4 +193,22 @@ PresentationRequest::PresentationRequest(ExecutionContext* executionContext,
       ActiveDOMObject(executionContext),
       m_url(url) {}
 
+ScriptPromise PresentationRequest::rejectWithMixedContentException(
+    ScriptState* scriptState) {
+  return ScriptPromise::rejectWithDOMException(
+      scriptState,
+      DOMException::create(SecurityError,
+                           "Settings prohibit mixed security contexts and "
+                           "url is an a priori unauthenticated URL. Url: " +

[mark a. foltz, 2016/10/20 21:56:14]

I would say: "Presentation of an insecure document <m_url> is prohibited from a
secure context."

[zhaobin, 2016/10/21 03:39:02]

Done.

+                               m_url.getString()));
+}
+
+ScriptPromise PresentationRequest::rejectWithSandBoxException(
+    ScriptState* scriptState) {
+  return ScriptPromise::rejectWithDOMException(
+      scriptState, DOMException::create(SecurityError,
+                                        "The document is sandboxed and lacks "
+                                        "the 'allow-presentation' flag."));
+}
+
 }  // namespace blink