Separate ContentSettingsClient out from LocalFrameClient

third_party/WebKit/Source/core/loader/MixedContentChecker.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 11 matching lines @@
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "core/loader/MixedContentChecker.h"
 
 #include "core/dom/Document.h"
+#include "core/frame/ContentSettingsClient.h"
 #include "core/frame/Frame.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/network/NetworkUtils.h"
@@ skipping 274 matching lines @@
 
   MixedContentChecker::count(mixedFrame, requestContext);
   if (ContentSecurityPolicy* policy =
           frame->securityContext()->contentSecurityPolicy())
     policy->reportMixedContent(url, redirectStatus);
 
   Settings* settings = mixedFrame->settings();
   // Use the current local frame's client; the embedder doesn't distinguish
   // mixed content signals from different frames on the same page.
   LocalFrameClient* client = frame->loader().client();
+  ContentSettingsClient* contentSettingsClient = frame->contentSettingsClient();
   SecurityOrigin* securityOrigin =
       mixedFrame->securityContext()->getSecurityOrigin();
   bool allowed = false;
 
   // If we're in strict mode, we'll automagically fail everything, and
   // intentionally skip the client checks in order to prevent degrading the
   // site's security UI.
   bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() &
                         kBlockAllMixedContent ||
                     settings->getStrictMixedContentChecking();
@@ skipping 11 matching lines @@
   // launching external applications via URLs. http://crbug.com/318788 and
   // https://crbug.com/393481
   if (frameType == WebURLRequest::FrameTypeNested &&
       !SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(url.protocol()))
     contextType = WebMixedContentContextType::OptionallyBlockable;
 
   switch (contextType) {
     case WebMixedContentContextType::OptionallyBlockable:
       allowed = !strictMode;
       if (allowed) {
-        client->passiveInsecureContentFound(url);
+        contentSettingsClient->passiveInsecureContentFound(url);
         client->didDisplayInsecureContent();
       }
       break;
 
     case WebMixedContentContextType::Blockable: {
       // Strictly block subresources that are mixed with respect to their
       // subframes, unless all insecure content is allowed. This is to avoid the
       // following situation: https://a.com embeds https://b.com, which loads a
       // script over insecure HTTP. The user opts to allow the insecure content,
       // thinking that they are allowing an insecure script to run on
       // https://a.com and not realizing that they are in fact allowing an
       // insecure script on https://b.com.
       if (!settings->getAllowRunningOfInsecureContent() &&
           requestIsSubframeSubresource(effectiveFrame, frameType) &&
           isMixedContent(frame->securityContext()->getSecurityOrigin(), url)) {
         UseCounter::count(mixedFrame,
                           UseCounter::BlockableMixedContentInSubframeBlocked);
         allowed = false;
         break;
       }
 
       bool shouldAskEmbedder =
           !strictMode && settings &&
           (!settings->getStrictlyBlockBlockableMixedContent() ||
            settings->getAllowRunningOfInsecureContent());
       allowed = shouldAskEmbedder &&
-                client->allowRunningInsecureContent(
+                contentSettingsClient->allowRunningInsecureContent(
                     settings && settings->getAllowRunningOfInsecureContent(),
                     securityOrigin, url);
       if (allowed) {
         client->didRunInsecureContent(securityOrigin, url);
         UseCounter::count(mixedFrame, UseCounter::MixedContentBlockableAllowed);
       }
       break;
     }
 
     case WebMixedContentContextType::ShouldBeBlockable:
@@ skipping 47 matching lines @@
   UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket);
   if (ContentSecurityPolicy* policy =
           frame->securityContext()->contentSecurityPolicy()) {
     policy->reportMixedContent(url,
                                ResourceRequest::RedirectStatus::NoRedirect);
   }
 
   Settings* settings = mixedFrame->settings();
   // Use the current local frame's client; the embedder doesn't distinguish
   // mixed content signals from different frames on the same page.
-  LocalFrameClient* client = frame->loader().client();
+  ContentSettingsClient* contentSettingsClient = frame->contentSettingsClient();
+  LocalFrameClient* client = frame->client();
   SecurityOrigin* securityOrigin =
       mixedFrame->securityContext()->getSecurityOrigin();
   bool allowed = false;
 
   // If we're in strict mode, we'll automagically fail everything, and
   // intentionally skip the client checks in order to prevent degrading the
   // site's security UI.
   bool strictMode = mixedFrame->securityContext()->getInsecureRequestPolicy() &
                         kBlockAllMixedContent ||
                     settings->getStrictMixedContentChecking();
   if (!strictMode) {
     bool allowedPerSettings =
         settings && settings->getAllowRunningOfInsecureContent();
-    allowed = client->allowRunningInsecureContent(allowedPerSettings,
-                                                  securityOrigin, url);
+    allowed = contentSettingsClient->allowRunningInsecureContent(
+        allowedPerSettings, securityOrigin, url);
   }
 
   if (allowed)
     client->didRunInsecureContent(securityOrigin, url);
 
   if (reportingPolicy == SecurityViolationReportingPolicy::Report) {
     logToConsoleAboutWebSocket(frame, mainResourceUrlForFrame(mixedFrame), url,
                                allowed);
   }
   return !allowed;
@@ skipping 143 matching lines @@
   }
 
   bool strictMixedContentCheckingForPlugin =
       mixedFrame->settings() &&
       mixedFrame->settings()->getStrictMixedContentCheckingForPlugin();
   return WebMixedContent::contextTypeFromRequestContext(
       request.requestContext(), strictMixedContentCheckingForPlugin);
 }
 
 }  // namespace blink