| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2012 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * | 7 * |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 153 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 164 void MixedContentChecker::count(Frame* frame, | 164 void MixedContentChecker::count(Frame* frame, |
| 165 WebURLRequest::RequestContext requestContext) { | 165 WebURLRequest::RequestContext requestContext) { |
| 166 UseCounter::count(frame, UseCounter::MixedContentPresent); | 166 UseCounter::count(frame, UseCounter::MixedContentPresent); |
| 167 | 167 |
| 168 // Roll blockable content up into a single counter, count unblocked types | 168 // Roll blockable content up into a single counter, count unblocked types |
| 169 // individually so we can determine when they can be safely moved to the | 169 // individually so we can determine when they can be safely moved to the |
| 170 // blockable category: | 170 // blockable category: |
| 171 WebMixedContent::ContextType contextType = | 171 WebMixedContent::ContextType contextType = |
| 172 WebMixedContent::contextTypeFromRequestContext( | 172 WebMixedContent::contextTypeFromRequestContext( |
| 173 requestContext, | 173 requestContext, |
| 174 frame->settings()->strictMixedContentCheckingForPlugin()); | 174 frame->settings()->getStrictMixedContentCheckingForPlugin()); |
| 175 if (contextType == WebMixedContent::ContextType::Blockable) { | 175 if (contextType == WebMixedContent::ContextType::Blockable) { |
| 176 UseCounter::count(frame, UseCounter::MixedContentBlockable); | 176 UseCounter::count(frame, UseCounter::MixedContentBlockable); |
| 177 return; | 177 return; |
| 178 } | 178 } |
| 179 | 179 |
| 180 UseCounter::Feature feature; | 180 UseCounter::Feature feature; |
| 181 switch (requestContext) { | 181 switch (requestContext) { |
| 182 case WebURLRequest::RequestContextAudio: | 182 case WebURLRequest::RequestContextAudio: |
| 183 feature = UseCounter::MixedContentAudio; | 183 feature = UseCounter::MixedContentAudio; |
| 184 break; | 184 break; |
| (...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 236 FrameLoaderClient* client = frame->loader().client(); | 236 FrameLoaderClient* client = frame->loader().client(); |
| 237 SecurityOrigin* securityOrigin = | 237 SecurityOrigin* securityOrigin = |
| 238 mixedFrame->securityContext()->getSecurityOrigin(); | 238 mixedFrame->securityContext()->getSecurityOrigin(); |
| 239 bool allowed = false; | 239 bool allowed = false; |
| 240 | 240 |
| 241 // If we're in strict mode, we'll automagically fail everything, and | 241 // If we're in strict mode, we'll automagically fail everything, and |
| 242 // intentionally skip the client checks in order to prevent degrading the | 242 // intentionally skip the client checks in order to prevent degrading the |
| 243 // site's security UI. | 243 // site's security UI. |
| 244 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & | 244 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & |
| 245 kBlockAllMixedContent || | 245 kBlockAllMixedContent || |
| 246 settings->strictMixedContentChecking(); | 246 settings->getStrictMixedContentChecking(); |
| 247 | 247 |
| 248 WebMixedContent::ContextType contextType = | 248 WebMixedContent::ContextType contextType = |
| 249 WebMixedContent::contextTypeFromRequestContext( | 249 WebMixedContent::contextTypeFromRequestContext( |
| 250 requestContext, settings->strictMixedContentCheckingForPlugin()); | 250 requestContext, settings->getStrictMixedContentCheckingForPlugin()); |
| 251 | 251 |
| 252 // If we're loading the main resource of a subframe, we need to take a close | 252 // If we're loading the main resource of a subframe, we need to take a close |
| 253 // look at the loaded URL. If we're dealing with a CORS-enabled scheme, then | 253 // look at the loaded URL. If we're dealing with a CORS-enabled scheme, then |
| 254 // block mixed frames as active content. Otherwise, treat frames as passive | 254 // block mixed frames as active content. Otherwise, treat frames as passive |
| 255 // content. | 255 // content. |
| 256 // | 256 // |
| 257 // FIXME: Remove this temporary hack once we have a reasonable API for | 257 // FIXME: Remove this temporary hack once we have a reasonable API for |
| 258 // launching external applications via URLs. http://crbug.com/318788 and | 258 // launching external applications via URLs. http://crbug.com/318788 and |
| 259 // https://crbug.com/393481 | 259 // https://crbug.com/393481 |
| 260 if (frameType == WebURLRequest::FrameTypeNested && | 260 if (frameType == WebURLRequest::FrameTypeNested && |
| (...skipping 10 matching lines...) Expand all Loading... |
| 271 break; | 271 break; |
| 272 | 272 |
| 273 case WebMixedContent::ContextType::Blockable: { | 273 case WebMixedContent::ContextType::Blockable: { |
| 274 // Strictly block subresources that are mixed with respect to their | 274 // Strictly block subresources that are mixed with respect to their |
| 275 // subframes, unless all insecure content is allowed. This is to avoid the | 275 // subframes, unless all insecure content is allowed. This is to avoid the |
| 276 // following situation: https://a.com embeds https://b.com, which loads a | 276 // following situation: https://a.com embeds https://b.com, which loads a |
| 277 // script over insecure HTTP. The user opts to allow the insecure content, | 277 // script over insecure HTTP. The user opts to allow the insecure content, |
| 278 // thinking that they are allowing an insecure script to run on | 278 // thinking that they are allowing an insecure script to run on |
| 279 // https://a.com and not realizing that they are in fact allowing an | 279 // https://a.com and not realizing that they are in fact allowing an |
| 280 // insecure script on https://b.com. | 280 // insecure script on https://b.com. |
| 281 if (!settings->allowRunningOfInsecureContent() && | 281 if (!settings->getAllowRunningOfInsecureContent() && |
| 282 requestIsSubframeSubresource(effectiveFrame, frameType) && | 282 requestIsSubframeSubresource(effectiveFrame, frameType) && |
| 283 isMixedContent(frame->securityContext()->getSecurityOrigin(), url)) { | 283 isMixedContent(frame->securityContext()->getSecurityOrigin(), url)) { |
| 284 UseCounter::count(mixedFrame, | 284 UseCounter::count(mixedFrame, |
| 285 UseCounter::BlockableMixedContentInSubframeBlocked); | 285 UseCounter::BlockableMixedContentInSubframeBlocked); |
| 286 allowed = false; | 286 allowed = false; |
| 287 break; | 287 break; |
| 288 } | 288 } |
| 289 | 289 |
| 290 bool shouldAskEmbedder = | 290 bool shouldAskEmbedder = |
| 291 !strictMode && settings && | 291 !strictMode && settings && |
| 292 (!settings->strictlyBlockBlockableMixedContent() || | 292 (!settings->getStrictlyBlockBlockableMixedContent() || |
| 293 settings->allowRunningOfInsecureContent()); | 293 settings->getAllowRunningOfInsecureContent()); |
| 294 allowed = shouldAskEmbedder && | 294 allowed = shouldAskEmbedder && |
| 295 client->allowRunningInsecureContent( | 295 client->allowRunningInsecureContent( |
| 296 settings && settings->allowRunningOfInsecureContent(), | 296 settings && settings->getAllowRunningOfInsecureContent(), |
| 297 securityOrigin, url); | 297 securityOrigin, url); |
| 298 if (allowed) { | 298 if (allowed) { |
| 299 client->didRunInsecureContent(securityOrigin, url); | 299 client->didRunInsecureContent(securityOrigin, url); |
| 300 UseCounter::count(mixedFrame, UseCounter::MixedContentBlockableAllowed); | 300 UseCounter::count(mixedFrame, UseCounter::MixedContentBlockableAllowed); |
| 301 } | 301 } |
| 302 break; | 302 break; |
| 303 } | 303 } |
| 304 | 304 |
| 305 case WebMixedContent::ContextType::ShouldBeBlockable: | 305 case WebMixedContent::ContextType::ShouldBeBlockable: |
| 306 allowed = !strictMode; | 306 allowed = !strictMode; |
| (...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 363 FrameLoaderClient* client = frame->loader().client(); | 363 FrameLoaderClient* client = frame->loader().client(); |
| 364 SecurityOrigin* securityOrigin = | 364 SecurityOrigin* securityOrigin = |
| 365 mixedFrame->securityContext()->getSecurityOrigin(); | 365 mixedFrame->securityContext()->getSecurityOrigin(); |
| 366 bool allowed = false; | 366 bool allowed = false; |
| 367 | 367 |
| 368 // If we're in strict mode, we'll automagically fail everything, and | 368 // If we're in strict mode, we'll automagically fail everything, and |
| 369 // intentionally skip the client checks in order to prevent degrading the | 369 // intentionally skip the client checks in order to prevent degrading the |
| 370 // site's security UI. | 370 // site's security UI. |
| 371 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & | 371 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & |
| 372 kBlockAllMixedContent || | 372 kBlockAllMixedContent || |
| 373 settings->strictMixedContentChecking(); | 373 settings->getStrictMixedContentChecking(); |
| 374 if (!strictMode) { | 374 if (!strictMode) { |
| 375 bool allowedPerSettings = | 375 bool allowedPerSettings = |
| 376 settings && settings->allowRunningOfInsecureContent(); | 376 settings && settings->getAllowRunningOfInsecureContent(); |
| 377 allowed = client->allowRunningInsecureContent(allowedPerSettings, | 377 allowed = client->allowRunningInsecureContent(allowedPerSettings, |
| 378 securityOrigin, url); | 378 securityOrigin, url); |
| 379 } | 379 } |
| 380 | 380 |
| 381 if (allowed) | 381 if (allowed) |
| 382 client->didRunInsecureContent(securityOrigin, url); | 382 client->didRunInsecureContent(securityOrigin, url); |
| 383 | 383 |
| 384 if (reportingStatus == SendReport) { | 384 if (reportingStatus == SendReport) { |
| 385 logToConsoleAboutWebSocket(frame, mainResourceUrlForFrame(mixedFrame), url, | 385 logToConsoleAboutWebSocket(frame, mainResourceUrlForFrame(mixedFrame), url, |
| 386 allowed); | 386 allowed); |
| (...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 467 WebURLRequest::RequestContext requestContext) { | 467 WebURLRequest::RequestContext requestContext) { |
| 468 Frame* effectiveFrame = effectiveFrameForFrameType(frame, frameType); | 468 Frame* effectiveFrame = effectiveFrameForFrameType(frame, frameType); |
| 469 if (frameType == WebURLRequest::FrameTypeTopLevel || !effectiveFrame) | 469 if (frameType == WebURLRequest::FrameTypeTopLevel || !effectiveFrame) |
| 470 return; | 470 return; |
| 471 | 471 |
| 472 // Use the current local frame's client; the embedder doesn't distinguish | 472 // Use the current local frame's client; the embedder doesn't distinguish |
| 473 // mixed content signals from different frames on the same page. | 473 // mixed content signals from different frames on the same page. |
| 474 FrameLoaderClient* client = frame->loader().client(); | 474 FrameLoaderClient* client = frame->loader().client(); |
| 475 bool strictMixedContentCheckingForPlugin = | 475 bool strictMixedContentCheckingForPlugin = |
| 476 effectiveFrame->settings() && | 476 effectiveFrame->settings() && |
| 477 effectiveFrame->settings()->strictMixedContentCheckingForPlugin(); | 477 effectiveFrame->settings()->getStrictMixedContentCheckingForPlugin(); |
| 478 WebMixedContent::ContextType contextType = | 478 WebMixedContent::ContextType contextType = |
| 479 WebMixedContent::contextTypeFromRequestContext( | 479 WebMixedContent::contextTypeFromRequestContext( |
| 480 requestContext, strictMixedContentCheckingForPlugin); | 480 requestContext, strictMixedContentCheckingForPlugin); |
| 481 if (contextType == WebMixedContent::ContextType::Blockable) { | 481 if (contextType == WebMixedContent::ContextType::Blockable) { |
| 482 client->didRunContentWithCertificateErrors(response.url()); | 482 client->didRunContentWithCertificateErrors(response.url()); |
| 483 } else { | 483 } else { |
| 484 // contextTypeFromRequestContext() never returns NotMixedContent (it | 484 // contextTypeFromRequestContext() never returns NotMixedContent (it |
| 485 // computes the type of mixed content, given that the content is mixed). | 485 // computes the type of mixed content, given that the content is mixed). |
| 486 DCHECK_NE(contextType, WebMixedContent::ContextType::NotMixedContent); | 486 DCHECK_NE(contextType, WebMixedContent::ContextType::NotMixedContent); |
| 487 client->didDisplayContentWithCertificateErrors(response.url()); | 487 client->didDisplayContentWithCertificateErrors(response.url()); |
| (...skipping 14 matching lines...) Expand all Loading... |
| 502 // See comment in shouldBlockFetch() about loading the main resource of a | 502 // See comment in shouldBlockFetch() about loading the main resource of a |
| 503 // subframe. | 503 // subframe. |
| 504 if (request.frameType() == WebURLRequest::FrameTypeNested && | 504 if (request.frameType() == WebURLRequest::FrameTypeNested && |
| 505 !SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled( | 505 !SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled( |
| 506 request.url().protocol())) { | 506 request.url().protocol())) { |
| 507 return WebMixedContent::ContextType::OptionallyBlockable; | 507 return WebMixedContent::ContextType::OptionallyBlockable; |
| 508 } | 508 } |
| 509 | 509 |
| 510 bool strictMixedContentCheckingForPlugin = | 510 bool strictMixedContentCheckingForPlugin = |
| 511 mixedFrame->settings() && | 511 mixedFrame->settings() && |
| 512 mixedFrame->settings()->strictMixedContentCheckingForPlugin(); | 512 mixedFrame->settings()->getStrictMixedContentCheckingForPlugin(); |
| 513 return WebMixedContent::contextTypeFromRequestContext( | 513 return WebMixedContent::contextTypeFromRequestContext( |
| 514 request.requestContext(), strictMixedContentCheckingForPlugin); | 514 request.requestContext(), strictMixedContentCheckingForPlugin); |
| 515 } | 515 } |
| 516 | 516 |
| 517 } // namespace blink | 517 } // namespace blink |
| OLD | NEW |