Use origins instead of URLs in console messages about mixed content.

content/browser/frame_host/mixed_content_navigation_throttle.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/mixed_content_navigation_throttle.h"
 
 #include "base/memory/ptr_util.h"
 #include "base/stl_util.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ skipping 66 matching lines @@
   return is_secure;
 }
 
 // This method should return the same results as
 // SchemeRegistry::shouldTreatURLSchemeAsRestrictingMixedContent.
 bool DoesOriginSchemeRestrictMixedContent(const url::Origin& origin) {
   return origin.scheme() == url::kHttpsScheme;
 }
 
 void UpdateRendererOnMixedContentFound(NavigationHandleImpl* navigation_handle,
-                                       const GURL& mixed_content_url,
+                                       FrameTreeNode* mixed_content_node,
                                        bool was_allowed,
                                        bool for_redirect) {
   // TODO(carlosk): the root node should never be considered as being/having
   // mixed content for now. Once/if the browser should also check form submits
   // for mixed content than this will be allowed to happen and this DCHECK
   // should be updated.
   DCHECK(navigation_handle->frame_tree_node()->parent());
-  RenderFrameHost* rfh =
+  RenderFrameHostImpl* rfh =
       navigation_handle->frame_tree_node()->current_frame_host();
+
+  // If mixed content is triggered by a navigation in a cross-site subframe,
+  // ensure that the source URL and source location in the "mixed" frame are
+  // not disclosed to the subframe, which might be in a separate renderer.  For
+  // example, if https://foo.com/sensitive.html embeds an OOPIF for
+  // http://bar.com, the mixed content IPC will be sent to http://bar.com, and
+  // we should not disclose the full foo.com URL or the source location in
+  // foo.com which caused the navigation to bar.com.
+  // See https://crbug.com/718942.
+  //
+  // TODO(arthursonzogni): Stop hiding sensitive parts of URLs in console error
+  // messages as soon as there is a way to send them to the devtools process
+  // without the round trip to the renderer process.
+  // See https://crbug.com/721329.
+  GURL safe_mixed_content_url = mixed_content_node->current_url();
+  SourceLocation safe_source_location = navigation_handle->source_location();
+  if (mixed_content_node != navigation_handle->frame_tree_node()) {
+    rfh->SanitizeDataForUseInCspViolation(for_redirect, CSPDirective::Unknown,
+                                          &safe_mixed_content_url,
+                                          &safe_source_location);
+  }
+
   FrameMsg_MixedContentFound_Params params;
-  params.main_resource_url = mixed_content_url;
+  params.main_resource_url = safe_mixed_content_url;
   params.mixed_content_url = navigation_handle->GetURL();
   params.request_context_type = navigation_handle->request_context_type();
   params.was_allowed = was_allowed;
   params.had_redirect = for_redirect;
-  params.source_location = navigation_handle->source_location();
+  params.source_location = safe_source_location;
 
   rfh->Send(new FrameMsg_MixedContentFound(rfh->GetRoutingID(), params));
 }
 
 }  // namespace
 
 namespace content {
 
 // static
 std::unique_ptr<NavigationThrottle>
@@ skipping 121 matching lines @@
       allowed = !strict_mode;
       if (allowed)
         frame_host_delegate->DidDisplayInsecureContent();
       break;
 
     case blink::WebMixedContentContextType::kNotMixedContent:
       NOTREACHED();
       break;
   };
 
-  UpdateRendererOnMixedContentFound(
-      handle_impl, mixed_content_node->current_url(), allowed, for_redirect);
+  UpdateRendererOnMixedContentFound(handle_impl, mixed_content_node, allowed,
+                                    for_redirect);
   MaybeSendBlinkFeatureUsageReport();
 
   return !allowed;
 }
 
 // This method mirrors MixedContentChecker::inWhichFrameIsContentMixed but is
 // implemented in a different form that seems more appropriate here.
 FrameTreeNode* MixedContentNavigationThrottle::InWhichFrameIsContentMixed(
     FrameTreeNode* node,
     const GURL& url) {
@@ skipping 101 matching lines @@
 // static
 bool MixedContentNavigationThrottle::IsMixedContentForTesting(
     const GURL& origin_url,
     const GURL& url) {
   const url::Origin origin(origin_url);
   return !IsUrlPotentiallySecure(url) &&
          DoesOriginSchemeRestrictMixedContent(origin);
 }
 
 }  // namespace content