| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2012 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * | 7 * |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 13 matching lines...) Expand all Loading... |
| 24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 27 */ | 27 */ |
| 28 | 28 |
| 29 #include "core/loader/MixedContentChecker.h" | 29 #include "core/loader/MixedContentChecker.h" |
| 30 | 30 |
| 31 #include "core/dom/Document.h" | 31 #include "core/dom/Document.h" |
| 32 #include "core/frame/Frame.h" | 32 #include "core/frame/Frame.h" |
| 33 #include "core/frame/LocalFrame.h" | 33 #include "core/frame/LocalFrame.h" |
| 34 #include "core/frame/LocalFrameClient.h" |
| 34 #include "core/frame/Settings.h" | 35 #include "core/frame/Settings.h" |
| 35 #include "core/frame/UseCounter.h" | 36 #include "core/frame/UseCounter.h" |
| 36 #include "core/inspector/ConsoleMessage.h" | 37 #include "core/inspector/ConsoleMessage.h" |
| 37 #include "core/loader/DocumentLoader.h" | 38 #include "core/loader/DocumentLoader.h" |
| 38 #include "core/loader/FrameLoader.h" | 39 #include "core/loader/FrameLoader.h" |
| 39 #include "core/loader/FrameLoaderClient.h" | |
| 40 #include "platform/RuntimeEnabledFeatures.h" | 40 #include "platform/RuntimeEnabledFeatures.h" |
| 41 #include "platform/network/NetworkUtils.h" | 41 #include "platform/network/NetworkUtils.h" |
| 42 #include "platform/weborigin/SchemeRegistry.h" | 42 #include "platform/weborigin/SchemeRegistry.h" |
| 43 #include "platform/weborigin/SecurityOrigin.h" | 43 #include "platform/weborigin/SecurityOrigin.h" |
| 44 #include "public/platform/WebAddressSpace.h" | 44 #include "public/platform/WebAddressSpace.h" |
| 45 #include "public/platform/WebInsecureRequestPolicy.h" | 45 #include "public/platform/WebInsecureRequestPolicy.h" |
| 46 #include "public/platform/WebMixedContent.h" | 46 #include "public/platform/WebMixedContent.h" |
| 47 #include "wtf/text/StringBuilder.h" | 47 #include "wtf/text/StringBuilder.h" |
| 48 | 48 |
| 49 namespace blink { | 49 namespace blink { |
| (...skipping 258 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 308 return false; | 308 return false; |
| 309 | 309 |
| 310 MixedContentChecker::count(mixedFrame, requestContext); | 310 MixedContentChecker::count(mixedFrame, requestContext); |
| 311 if (ContentSecurityPolicy* policy = | 311 if (ContentSecurityPolicy* policy = |
| 312 frame->securityContext()->contentSecurityPolicy()) | 312 frame->securityContext()->contentSecurityPolicy()) |
| 313 policy->reportMixedContent(url, redirectStatus); | 313 policy->reportMixedContent(url, redirectStatus); |
| 314 | 314 |
| 315 Settings* settings = mixedFrame->settings(); | 315 Settings* settings = mixedFrame->settings(); |
| 316 // Use the current local frame's client; the embedder doesn't distinguish | 316 // Use the current local frame's client; the embedder doesn't distinguish |
| 317 // mixed content signals from different frames on the same page. | 317 // mixed content signals from different frames on the same page. |
| 318 FrameLoaderClient* client = frame->loader().client(); | 318 LocalFrameClient* client = frame->loader().client(); |
| 319 SecurityOrigin* securityOrigin = | 319 SecurityOrigin* securityOrigin = |
| 320 mixedFrame->securityContext()->getSecurityOrigin(); | 320 mixedFrame->securityContext()->getSecurityOrigin(); |
| 321 bool allowed = false; | 321 bool allowed = false; |
| 322 | 322 |
| 323 // If we're in strict mode, we'll automagically fail everything, and | 323 // If we're in strict mode, we'll automagically fail everything, and |
| 324 // intentionally skip the client checks in order to prevent degrading the | 324 // intentionally skip the client checks in order to prevent degrading the |
| 325 // site's security UI. | 325 // site's security UI. |
| 326 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & | 326 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & |
| 327 kBlockAllMixedContent || | 327 kBlockAllMixedContent || |
| 328 settings->getStrictMixedContentChecking(); | 328 settings->getStrictMixedContentChecking(); |
| (...skipping 106 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 435 UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket); | 435 UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket); |
| 436 if (ContentSecurityPolicy* policy = | 436 if (ContentSecurityPolicy* policy = |
| 437 frame->securityContext()->contentSecurityPolicy()) { | 437 frame->securityContext()->contentSecurityPolicy()) { |
| 438 policy->reportMixedContent(url, | 438 policy->reportMixedContent(url, |
| 439 ResourceRequest::RedirectStatus::NoRedirect); | 439 ResourceRequest::RedirectStatus::NoRedirect); |
| 440 } | 440 } |
| 441 | 441 |
| 442 Settings* settings = mixedFrame->settings(); | 442 Settings* settings = mixedFrame->settings(); |
| 443 // Use the current local frame's client; the embedder doesn't distinguish | 443 // Use the current local frame's client; the embedder doesn't distinguish |
| 444 // mixed content signals from different frames on the same page. | 444 // mixed content signals from different frames on the same page. |
| 445 FrameLoaderClient* client = frame->loader().client(); | 445 LocalFrameClient* client = frame->loader().client(); |
| 446 SecurityOrigin* securityOrigin = | 446 SecurityOrigin* securityOrigin = |
| 447 mixedFrame->securityContext()->getSecurityOrigin(); | 447 mixedFrame->securityContext()->getSecurityOrigin(); |
| 448 bool allowed = false; | 448 bool allowed = false; |
| 449 | 449 |
| 450 // If we're in strict mode, we'll automagically fail everything, and | 450 // If we're in strict mode, we'll automagically fail everything, and |
| 451 // intentionally skip the client checks in order to prevent degrading the | 451 // intentionally skip the client checks in order to prevent degrading the |
| 452 // site's security UI. | 452 // site's security UI. |
| 453 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & | 453 bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() & |
| 454 kBlockAllMixedContent || | 454 kBlockAllMixedContent || |
| 455 settings->getStrictMixedContentChecking(); | 455 settings->getStrictMixedContentChecking(); |
| (...skipping 90 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 546 LocalFrame* frame, | 546 LocalFrame* frame, |
| 547 const ResourceResponse& response, | 547 const ResourceResponse& response, |
| 548 WebURLRequest::FrameType frameType, | 548 WebURLRequest::FrameType frameType, |
| 549 WebURLRequest::RequestContext requestContext) { | 549 WebURLRequest::RequestContext requestContext) { |
| 550 Frame* effectiveFrame = effectiveFrameForFrameType(frame, frameType); | 550 Frame* effectiveFrame = effectiveFrameForFrameType(frame, frameType); |
| 551 if (frameType == WebURLRequest::FrameTypeTopLevel || !effectiveFrame) | 551 if (frameType == WebURLRequest::FrameTypeTopLevel || !effectiveFrame) |
| 552 return; | 552 return; |
| 553 | 553 |
| 554 // Use the current local frame's client; the embedder doesn't distinguish | 554 // Use the current local frame's client; the embedder doesn't distinguish |
| 555 // mixed content signals from different frames on the same page. | 555 // mixed content signals from different frames on the same page. |
| 556 FrameLoaderClient* client = frame->loader().client(); | 556 LocalFrameClient* client = frame->loader().client(); |
| 557 bool strictMixedContentCheckingForPlugin = | 557 bool strictMixedContentCheckingForPlugin = |
| 558 effectiveFrame->settings() && | 558 effectiveFrame->settings() && |
| 559 effectiveFrame->settings()->getStrictMixedContentCheckingForPlugin(); | 559 effectiveFrame->settings()->getStrictMixedContentCheckingForPlugin(); |
| 560 WebMixedContentContextType contextType = | 560 WebMixedContentContextType contextType = |
| 561 WebMixedContent::contextTypeFromRequestContext( | 561 WebMixedContent::contextTypeFromRequestContext( |
| 562 requestContext, strictMixedContentCheckingForPlugin); | 562 requestContext, strictMixedContentCheckingForPlugin); |
| 563 if (contextType == WebMixedContentContextType::Blockable) { | 563 if (contextType == WebMixedContentContextType::Blockable) { |
| 564 client->didRunContentWithCertificateErrors(response.url()); | 564 client->didRunContentWithCertificateErrors(response.url()); |
| 565 } else { | 565 } else { |
| 566 // contextTypeFromRequestContext() never returns NotMixedContent (it | 566 // contextTypeFromRequestContext() never returns NotMixedContent (it |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 612 } | 612 } |
| 613 | 613 |
| 614 bool strictMixedContentCheckingForPlugin = | 614 bool strictMixedContentCheckingForPlugin = |
| 615 mixedFrame->settings() && | 615 mixedFrame->settings() && |
| 616 mixedFrame->settings()->getStrictMixedContentCheckingForPlugin(); | 616 mixedFrame->settings()->getStrictMixedContentCheckingForPlugin(); |
| 617 return WebMixedContent::contextTypeFromRequestContext( | 617 return WebMixedContent::contextTypeFromRequestContext( |
| 618 request.requestContext(), strictMixedContentCheckingForPlugin); | 618 request.requestContext(), strictMixedContentCheckingForPlugin); |
| 619 } | 619 } |
| 620 | 620 |
| 621 } // namespace blink | 621 } // namespace blink |
| OLD | NEW |