chrome/browser/resources/ssl/overridable_v2.html - Issue 294343004: New SSL interstitial (behind Finch flag)

Side by Side Diff: chrome/browser/resources/ssl/overridable_v2.html

Issue 294343004: New SSL interstitial (behind Finch flag) (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Style fix Created 6 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « chrome/browser/resources/ssl/overridable_v2.css ('k') | chrome/browser/resources/ssl/overridable_v2.js » ('j') | chrome/browser/resources/ssl/overridable_v2.js » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html class="google" lang="en" i18n-values="dir:textDirection">
	Bernhard Bauer 2014/05/26 10:13:20 We always set lang="en"? We always set lang="en"? felt 2014/05/27 12:25:06 Ha, no. Copy and paste fail. Fixed. Show quoted text On 2014/05/26 10:13:20, Bernhard Bauer wrote: > We always set lang="en"? Ha, no. Copy and paste fail. Fixed.
	3 <head>

	4 <meta charset="utf-8">

	5 <meta name="viewport"

	6 content="initial-scale=1, minimum-scale=1, width=device-width">
	Bernhard Bauer 2014/05/26 10:13:20 Nit: Attributes aren't usually aligned. Just inden Nit: Attributes aren't usually aligned. Just indent the next line four spaces. felt 2014/05/27 12:25:06 Done. Show quoted text On 2014/05/26 10:13:20, Bernhard Bauer wrote: > Nit: Attributes aren't usually aligned. Just indent the next line four spaces. Done.
	7 <title i18n-content="tabTitle"></title>

	8 <link rel="stylesheet" href="overridable_v2.css">

	9 <script src="../../../../ui/webui/resources/js/util.js"></script>

	10 <script src="ssl_errors_common.js"></script>

	11 <script src="overridable_v2.js"></script>

	12 </head>

	13 <body>

	14 <div class="interstitial-wrapper">

	15 <div class="icon"></div>

	16 <div id="main-message">

	17 <h1 i18n-content="heading"></h1>

	18 <p i18n-values=".innerHTML:primaryParagraph"></p>

	19 </div>

	20 <div class="nav-wrapper">

	21 <button i18n-content="safetyButtonText" id="safety-button"></button>

	22 <a href="javascript:void(0)" id="details-button"
	Bernhard Bauer 2014/05/26 10:13:20 Just set the target to "#"? It's shorter, and you' Just set the target to "#"? It's shorter, and you'd be able to set a CSP that disallows inline script. felt 2014/05/27 12:25:06 Done. How do I set a CSP for a Chrome page? Is the Show quoted text On 2014/05/26 10:13:20, Bernhard Bauer wrote: > Just set the target to "#"? It's shorter, and you'd be able to set a CSP that > disallows inline script. Done. How do I set a CSP for a Chrome page? Is there a way to set headers or is there a special CSP command? Bernhard Bauer 2014/05/27 14:13:34 Hm... The prefered way would be via HTTP headers, Show quoted text On 2014/05/27 12:25:06, felt wrote: > On 2014/05/26 10:13:20, Bernhard Bauer wrote: > > Just set the target to "#"? It's shorter, and you'd be able to set a CSP that > > disallows inline script. > > Done. How do I set a CSP for a Chrome page? Is there a way to set headers or is > there a special CSP command? Hm... The prefered way would be via HTTP headers, but if this is an interstitial page, IIRC it will be directly injected into its WebContents. I think you can use meta tags though: https://w3c.github.io/webappsec/specs/content-security-policy/#delivery-html-... felt 2014/05/28 12:56:29 I didn't know about the meta tags, cool. However, Show quoted text On 2014/05/27 14:13:34, Bernhard Bauer wrote: > On 2014/05/27 12:25:06, felt wrote: > > On 2014/05/26 10:13:20, Bernhard Bauer wrote: > > > Just set the target to "#"? It's shorter, and you'd be able to set a CSP > that > > > disallows inline script. > > > > Done. How do I set a CSP for a Chrome page? Is there a way to set headers or > is > > there a special CSP command? > > Hm... The prefered way would be via HTTP headers, but if this is an interstitial > page, IIRC it will be directly injected into its WebContents. I think you can > use meta tags though: > https://w3c.github.io/webappsec/specs/content-security-policy/#delivery-html-... I didn't know about the meta tags, cool. However, I've discovered two problems: 1. Applying a CSP that blocks inline scripts breaks the page. It looks like the templating system is adding inline scripts. Is it worth trying to figure out what is going on with the templating? There are no user- or website-supplied strings in the interstitial. 2. Doing href="#" causes a navigation that isn't permitted for interstitials. I originally assumed it was some other bug in how the c++ was handling CMD_MORE, but now I realize it's the "#" navigation. So this needs to be javascript:void(0) or something else that won't cause a navigation but still makes the link act like a link. Bernhard Bauer 2014/05/28 13:17:47 Hm, I don't know any reason why the templating sys Show quoted text On 2014/05/28 12:56:29, felt wrote: > On 2014/05/27 14:13:34, Bernhard Bauer wrote: > > On 2014/05/27 12:25:06, felt wrote: > > > On 2014/05/26 10:13:20, Bernhard Bauer wrote: > > > > Just set the target to "#"? It's shorter, and you'd be able to set a CSP > > that > > > > disallows inline script. > > > > > > Done. How do I set a CSP for a Chrome page? Is there a way to set headers or > > is > > > there a special CSP command? > > > > Hm... The prefered way would be via HTTP headers, but if this is an > interstitial > > page, IIRC it will be directly injected into its WebContents. I think you can > > use meta tags though: > > > https://w3c.github.io/webappsec/specs/content-security-policy/#delivery-html-... > > I didn't know about the meta tags, cool. However, I've discovered two problems: > > 1. Applying a CSP that blocks inline scripts breaks the page. It looks like the > templating system is adding inline scripts. Is it worth trying to figure out > what is going on with the templating? There are no user- or website-supplied > strings in the interstitial. Hm, I don't know any reason why the templating system should add inline scripts. If this is a general problem with i18n_template.js, it might be worth fixing, as that would allow other WebUI pages to apply CSP too. One thing I noticed is that you're using v1 of i18n_template.js. There is a newer version, which you'll get if you have an object of class webui::UseVersion2 in scope (don't ask me why). Maybe that will help already? Show quoted text > 2. Doing href="#" causes a navigation that isn't permitted for interstitials. I > originally assumed it was some other bug in how the c++ was handling CMD_MORE, > but now I realize it's the "#" navigation. So this needs to be > javascript:void(0) or something else that won't cause a navigation but still > makes the link act like a link. Oh, ok. Hm, to get rid of the inline script, maybe you could keep href="#" but set an event listener that will cancel the navigation? felt 2014/06/02 17:58:46 I've updated this to use the v2 and removed the in Show quoted text On 2014/05/28 13:17:47, Bernhard Bauer wrote: > On 2014/05/28 12:56:29, felt wrote: > > On 2014/05/27 14:13:34, Bernhard Bauer wrote: > > > On 2014/05/27 12:25:06, felt wrote: > > > > On 2014/05/26 10:13:20, Bernhard Bauer wrote: > > > > > Just set the target to "#"? It's shorter, and you'd be able to set a CSP > > > that > > > > > disallows inline script. > > > > > > > > Done. How do I set a CSP for a Chrome page? Is there a way to set headers > or > > > is > > > > there a special CSP command? > > > > > > Hm... The prefered way would be via HTTP headers, but if this is an > > interstitial > > > page, IIRC it will be directly injected into its WebContents. I think you > can > > > use meta tags though: > > > > > > https://w3c.github.io/webappsec/specs/content-security-policy/#delivery-html-... > > > > I didn't know about the meta tags, cool. However, I've discovered two > problems: > > > > 1. Applying a CSP that blocks inline scripts breaks the page. It looks like > the > > templating system is adding inline scripts. Is it worth trying to figure out > > what is going on with the templating? There are no user- or website-supplied > > strings in the interstitial. > > Hm, I don't know any reason why the templating system should add inline scripts. > If this is a general problem with i18n_template.js, it might be worth fixing, as > that would allow other WebUI pages to apply CSP too. > > One thing I noticed is that you're using v1 of i18n_template.js. There is a > newer version, which you'll get if you have an object of class > webui::UseVersion2 in scope (don't ask me why). Maybe that will help already? > > > 2. Doing href="#" causes a navigation that isn't permitted for interstitials. > I > > originally assumed it was some other bug in how the c++ was handling CMD_MORE, > > but now I realize it's the "#" navigation. So this needs to be > > javascript:void(0) or something else that won't cause a navigation but still > > makes the link act like a link. > > Oh, ok. Hm, to get rid of the inline script, maybe you could keep href="#" but > set an event listener that will cancel the navigation? I've updated this to use the v2 and removed the inline script in the <a> tag, but I keep getting CSP errors saying there is an inline script. I assume this must be something that's being done dynamically by one of the scripts I've included. I will investigate further, but I'd like to land this without the CSP. It's not particularly urgent here given that there is no untrusted content on the page.
	23 i18n-content="openDetails"></a>

	24 </div>

	25 <div id="details" class="hidden">

	26 <p i18n-values=".innerHTML:explanationParagraph"></p>

	27 <p i18n-values=".innerHTML:proceedParagraph"></p>

	28 </div>

	29 </div>

	30 </body>

	31 </html>

OLD	NEW