chrome/browser/resources/ssl/overridable_v2.html - Issue 294343004: New SSL interstitial (behind Finch flag)

Unified Diff: chrome/browser/resources/ssl/overridable_v2.html

Issue 294343004: New SSL interstitial (behind Finch flag) (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Style fix Created 6 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « chrome/browser/resources/ssl/overridable_v2.css ('k') | chrome/browser/resources/ssl/overridable_v2.js » ('j') | chrome/browser/resources/ssl/overridable_v2.js » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: chrome/browser/resources/ssl/overridable_v2.html

diff --git a/chrome/browser/resources/ssl/overridable_v2.html b/chrome/browser/resources/ssl/overridable_v2.html

new file mode 100644

index 0000000000000000000000000000000000000000..001fd7f80aee0859bc5eaa0cc7fbb419fd717fe0

--- /dev/null

+++ b/chrome/browser/resources/ssl/overridable_v2.html

@@ -0,0 +1,31 @@

+<!DOCTYPE html>

+<html class="google" lang="en" i18n-values="dir:textDirection">

Bernhard Bauer 2014/05/26 10:13:20 We always set lang="en"?

felt 2014/05/27 12:25:06 Ha, no. Copy and paste fail. Fixed.

+ <head>

+ <meta charset="utf-8">

+ <meta name="viewport"

+ content="initial-scale=1, minimum-scale=1, width=device-width">

Bernhard Bauer 2014/05/26 10:13:20 Nit: Attributes aren't usually aligned. Just inden

felt 2014/05/27 12:25:06 Done.

+ <title i18n-content="tabTitle"></title>

+ <link rel="stylesheet" href="overridable_v2.css">

+ <script src="../../../../ui/webui/resources/js/util.js"></script>

+ <script src="ssl_errors_common.js"></script>

+ <script src="overridable_v2.js"></script>

+ </head>

+<body>

+ <div class="interstitial-wrapper">

+ <div class="icon"></div>

+ <div id="main-message">

+ <h1 i18n-content="heading"></h1>

+ <p i18n-values=".innerHTML:primaryParagraph"></p>

+ </div>

+ <div class="nav-wrapper">

+ <button i18n-content="safetyButtonText" id="safety-button"></button>

+ <a href="javascript:void(0)" id="details-button"

Bernhard Bauer 2014/05/26 10:13:20 Just set the target to "#"? It's shorter, and you'

felt 2014/05/27 12:25:06 Done. How do I set a CSP for a Chrome page? Is the

Bernhard Bauer 2014/05/27 14:13:34 Hm... The prefered way would be via HTTP headers,

felt 2014/05/28 12:56:29 I didn't know about the meta tags, cool. However,

Bernhard Bauer 2014/05/28 13:17:47 Hm, I don't know any reason why the templating sys

Hm, I don't know any reason why the templating system should add inline scripts. If this is a general problem with i18n_template.js, it might be worth fixing, as that would allow other WebUI pages to apply CSP too. One thing I noticed is that you're using v1 of i18n_template.js. There is a newer version, which you'll get if you have an object of class webui::UseVersion2 in scope (don't ask me why). Maybe that will help already?

Oh, ok. Hm, to get rid of the inline script, maybe you could keep href="#" but set an event listener that will cancel the navigation?

felt 2014/06/02 17:58:46 I've updated this to use the v2 and removed the in

On 2014/05/28 13:17:47, Bernhard Bauer wrote: > On 2014/05/28 12:56:29, felt wrote: > > On 2014/05/27 14:13:34, Bernhard Bauer wrote: > > > On 2014/05/27 12:25:06, felt wrote: > > > > On 2014/05/26 10:13:20, Bernhard Bauer wrote: > > > > > Just set the target to "#"? It's shorter, and you'd be able to set a CSP > > > that > > > > > disallows inline script. > > > > > > > > Done. How do I set a CSP for a Chrome page? Is there a way to set headers > or > > > is > > > > there a special CSP command? > > > > > > Hm... The prefered way would be via HTTP headers, but if this is an > > interstitial > > > page, IIRC it will be directly injected into its WebContents. I think you > can > > > use meta tags though: > > > > > > https://w3c.github.io/webappsec/specs/content-security-policy/#delivery-html-... > > > > I didn't know about the meta tags, cool. However, I've discovered two > problems: > > > > 1. Applying a CSP that blocks inline scripts breaks the page. It looks like > the > > templating system is adding inline scripts. Is it worth trying to figure out > > what is going on with the templating? There are no user- or website-supplied > > strings in the interstitial. > > Hm, I don't know any reason why the templating system should add inline scripts. > If this is a general problem with i18n_template.js, it might be worth fixing, as > that would allow other WebUI pages to apply CSP too. > > One thing I noticed is that you're using v1 of i18n_template.js. There is a > newer version, which you'll get if you have an object of class > webui::UseVersion2 in scope (don't ask me why). Maybe that will help already? > > > 2. Doing href="#" causes a navigation that isn't permitted for interstitials. > I > > originally assumed it was some other bug in how the c++ was handling CMD_MORE, > > but now I realize it's the "#" navigation. So this needs to be > > javascript:void(0) or something else that won't cause a navigation but still > > makes the link act like a link. > > Oh, ok. Hm, to get rid of the inline script, maybe you could keep href="#" but > set an event listener that will cancel the navigation?

I've updated this to use the v2 and removed the inline script in the <a> tag, but I keep getting CSP errors saying there is an inline script. I assume this must be something that's being done dynamically by one of the scripts I've included. I will investigate further, but I'd like to land this without the CSP. It's not particularly urgent here given that there is no untrusted content on the page.

+ i18n-content="openDetails"></a>

+ </div>

+ <div id="details" class="hidden">

+ <p i18n-values=".innerHTML:explanationParagraph"></p>

+ <p i18n-values=".innerHTML:proceedParagraph"></p>

+ </div>

+</body>

+</html>