chrome/browser/ui/login/login_interstitial_delegate.cc - Issue 403933002: Set SSL info when an HTTP auth dialog is triggered by direct navigation.

Side by Side Diff: chrome/browser/ui/login/login_interstitial_delegate.cc

Issue 403933002: Set SSL info when an HTTP auth dialog is triggered by direct navigation. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Set SSL status for all HTTP basic auth prompts Created 6 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

OLD	NEW
1 // Copyright 2014 The Chromium Authors. All rights reserved.	1 // Copyright 2014 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include "chrome/browser/ui/login/login_interstitial_delegate.h"	5 #include "chrome/browser/ui/login/login_interstitial_delegate.h"

6	6

	7 #include "chrome/browser/ssl/ssl_error_info.h"

	8 #include "chrome/browser/ui/login/login_prompt.h"

	9 #include "content/public/browser/cert_store.h"

	10 #include "content/public/browser/navigation_entry.h"

	11 #include "content/public/browser/render_process_host.h"

	12 #include "content/public/browser/signed_certificate_timestamp_store.h"

	13 #include "content/public/browser/web_contents.h"

	14 #include "content/public/common/security_style.h"

	15 #include "content/public/common/signed_certificate_timestamp_id_and_status.h"

	16 #include "content/public/common/ssl_status.h"

	17 #include "net/ssl/ssl_info.h"
	meacer 2014/07/22 22:07:09 Some of these will be removed. Some of these will be removed.
	18

7 LoginInterstitialDelegate::LoginInterstitialDelegate(	19 LoginInterstitialDelegate::LoginInterstitialDelegate(

8 content::WebContents* web_contents,	20 content::WebContents* web_contents,

9 const GURL& request_url,	21 const GURL& request_url,

10 base::Closure& callback)	22 base::Closure& callback,

11 : callback_(callback) {	23 const net::SSLInfo& ssl_info)

	24 : web_contents_(web_contents),

	25 callback_(callback),

	26 ssl_info_(ssl_info) {

12 // The interstitial page owns us.	27 // The interstitial page owns us.

13 content::InterstitialPage* interstitial_page =	28 content::InterstitialPage* interstitial_page =

14 content::InterstitialPage::Create(web_contents,	29 content::InterstitialPage::Create(web_contents,

15 true,	30 true,

16 request_url,	31 request_url,

17 this);	32 this);

18 interstitial_page->Show();	33 interstitial_page->Show();

19 }	34 }

20	35

21 LoginInterstitialDelegate::~LoginInterstitialDelegate() {	36 LoginInterstitialDelegate::~LoginInterstitialDelegate() {

22 }	37 }

23	38

24 void LoginInterstitialDelegate::CommandReceived(const std::string& command) {	39 void LoginInterstitialDelegate::CommandReceived(const std::string& command) {

25 callback_.Run();	40 callback_.Run();

26 }	41 }

27	42

28 std::string LoginInterstitialDelegate::GetHTMLContents() {	43 std::string LoginInterstitialDelegate::GetHTMLContents() {

29 // Showing an interstitial results in a new navigation, and a new navigation	44 // Showing an interstitial results in a new navigation, and a new navigation

30 // closes all modal dialogs on the page. Therefore the login prompt must be	45 // closes all modal dialogs on the page. Therefore the login prompt must be

31 // shown after the interstitial is displayed. This is done by sending a	46 // shown after the interstitial is displayed. This is done by sending a

32 // command from the interstitial page as soon as it is loaded.	47 // command from the interstitial page as soon as it is loaded.

33 return std::string(	48 return std::string(

34 "<!DOCTYPE html>"	49 "<!DOCTYPE html>"

35 "<html><body><script>"	50 "<html><body><script>"

36 "window.domAutomationController.setAutomationId(1);"	51 "window.domAutomationController.setAutomationId(1);"

37 "window.domAutomationController.send('1');"	52 "window.domAutomationController.send('1');"

38 "</script></body></html>");	53 "</script></body></html>");

39 }	54 }

	55

	56 void LoginInterstitialDelegate::OverrideEntry(content::NavigationEntry* entry) {

	57 entry->GetSSL().security_style = content::SECURITY_STYLE_UNKNOWN;

	58 // LoginHandler::UpdateSSLState doesn't set the mixed content state, but the
	Charlie Reis 2014/07/22 22:01:21 This concerns me. Are you saying that there could This concerns me. Are you saying that there could be a mixed content warning that is missed while the login prompt is showing? That sounds bad. You could imagine a case where something like window.opener is on the same HTTPS origin and has mixed content. Once the user logs into what looked like a safe prompt, the mixed content opener reaches in and has access to the now-authenticated page. meacer 2014/07/22 22:07:09 Ah, I didn't consider the "mixed content on the sa Show quoted text On 2014/07/22 22:01:21, Charlie Reis wrote: > This concerns me. Are you saying that there could be a mixed content warning > that is missed while the login prompt is showing? That sounds bad. > > You could imagine a case where something like window.opener is on the same HTTPS > origin and has mixed content. Once the user logs into what looked like a safe > prompt, the mixed content opener reaches in and has access to the > now-authenticated page. Ah, I didn't consider the "mixed content on the same origin" case. I was assuming that the check was per page rather than per origin, but it makes sense for it to be per origin. The main problem here is that I can't seem to use SSLManager from UI code. If I can, then I won't need to duplicate the logic. Not sure if it's possible though. Charlie Reis 2014/07/22 23:23:18 Yeah, it would be good to find a way to expose the Show quoted text On 2014/07/22 22:07:09, Mustafa Emre Acer wrote: > On 2014/07/22 22:01:21, Charlie Reis wrote: > > This concerns me. Are you saying that there could be a mixed content warning > > that is missed while the login prompt is showing? That sounds bad. > > > > You could imagine a case where something like window.opener is on the same > HTTPS > > origin and has mixed content. Once the user logs into what looked like a safe > > prompt, the mixed content opener reaches in and has access to the > > now-authenticated page. > > Ah, I didn't consider the "mixed content on the same origin" case. I was > assuming that the check was per page rather than per origin, but it makes sense > for it to be per origin. > > The main problem here is that I can't seem to use SSLManager from UI code. If I > can, then I won't need to duplicate the logic. Not sure if it's possible though. Yeah, it would be good to find a way to expose the info that you need, because duplicating it outside of content/ will certainly lead to unfixed bugs. Not sure what content/public surface is the right place for it, so adding John to see if he has ideas.
	59 // navigation entry for this interstitial will be discarded once the login

	60 // prompt is closed anyways, and the SSL state will be updated correctly once

	61 // the pending navigation will commit.

	62 LoginHandler::UpdateSSLState(entry, web_contents_, ssl_info_);

	63 }

OLD	NEW

« no previous file with comments | « chrome/browser/ui/login/login_interstitial_delegate.h ('k') | chrome/browser/ui/login/login_prompt.h » ('j') | no next file with comments »