OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2012 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * | 7 * |
8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
(...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
102 case WebURLRequest::RequestContextTrack: | 102 case WebURLRequest::RequestContextTrack: |
103 case WebURLRequest::RequestContextWorker: | 103 case WebURLRequest::RequestContextWorker: |
104 case WebURLRequest::RequestContextXSLT: | 104 case WebURLRequest::RequestContextXSLT: |
105 return ContextTypeBlockable; | 105 return ContextTypeBlockable; |
106 | 106 |
107 // "Blockable" mixed content whose behavior changed recently, and which is t
hus guarded behind the "lax" flag | 107 // "Blockable" mixed content whose behavior changed recently, and which is t
hus guarded behind the "lax" flag |
108 case WebURLRequest::RequestContextEventSource: | 108 case WebURLRequest::RequestContextEventSource: |
109 case WebURLRequest::RequestContextXMLHttpRequest: | 109 case WebURLRequest::RequestContextXMLHttpRequest: |
110 return ContextTypeBlockableUnlessLax; | 110 return ContextTypeBlockableUnlessLax; |
111 | 111 |
112 // Contexts that we should block, but don't currently. | 112 // FIXME: Contexts that we should block, but don't currently. https://crbug.
com/388650 |
113 case WebURLRequest::RequestContextDownload: | 113 case WebURLRequest::RequestContextDownload: |
114 case WebURLRequest::RequestContextInternal: | 114 case WebURLRequest::RequestContextInternal: |
115 case WebURLRequest::RequestContextPlugin: | 115 case WebURLRequest::RequestContextPlugin: |
116 case WebURLRequest::RequestContextPrefetch: | 116 case WebURLRequest::RequestContextPrefetch: |
117 return ContextTypeShouldBeBlockable; | 117 return ContextTypeShouldBeBlockable; |
118 | 118 |
119 case WebURLRequest::RequestContextUnspecified: | 119 case WebURLRequest::RequestContextUnspecified: |
120 ASSERT_NOT_REACHED(); | 120 ASSERT_NOT_REACHED(); |
121 } | 121 } |
122 ASSERT_NOT_REACHED(); | 122 ASSERT_NOT_REACHED(); |
123 return ContextTypeBlockable; | 123 return ContextTypeBlockable; |
124 } | 124 } |
125 | 125 |
126 // static | 126 // static |
| 127 const char* MixedContentChecker::typeNameFromContext(WebURLRequest::RequestConte
xt context) |
| 128 { |
| 129 switch (context) { |
| 130 case WebURLRequest::RequestContextAudio: |
| 131 return "audio file"; |
| 132 case WebURLRequest::RequestContextBeacon: |
| 133 return "Beacon endpoint"; |
| 134 case WebURLRequest::RequestContextCSPReport: |
| 135 return "Content Security Policy reporting endpoint"; |
| 136 case WebURLRequest::RequestContextDownload: |
| 137 return "download"; |
| 138 case WebURLRequest::RequestContextEmbed: |
| 139 return "plugin resource"; |
| 140 case WebURLRequest::RequestContextEventSource: |
| 141 return "EventSource endpoint"; |
| 142 case WebURLRequest::RequestContextFavicon: |
| 143 return "favicon"; |
| 144 case WebURLRequest::RequestContextFetch: |
| 145 return "resource"; |
| 146 case WebURLRequest::RequestContextFont: |
| 147 return "font"; |
| 148 case WebURLRequest::RequestContextForm: |
| 149 return "form action"; |
| 150 case WebURLRequest::RequestContextFrame: |
| 151 return "frame"; |
| 152 case WebURLRequest::RequestContextHyperlink: |
| 153 return "resource"; |
| 154 case WebURLRequest::RequestContextIframe: |
| 155 return "frame"; |
| 156 case WebURLRequest::RequestContextImage: |
| 157 return "image"; |
| 158 case WebURLRequest::RequestContextImageSet: |
| 159 return "image"; |
| 160 case WebURLRequest::RequestContextImport: |
| 161 return "HTML Import"; |
| 162 case WebURLRequest::RequestContextInternal: |
| 163 return "resource"; |
| 164 case WebURLRequest::RequestContextLocation: |
| 165 return "resource"; |
| 166 case WebURLRequest::RequestContextManifest: |
| 167 return "manifest"; |
| 168 case WebURLRequest::RequestContextObject: |
| 169 return "plugin resource"; |
| 170 case WebURLRequest::RequestContextPing: |
| 171 return "hyperlink auditing endpoint"; |
| 172 case WebURLRequest::RequestContextPlugin: |
| 173 return "plugin data"; |
| 174 case WebURLRequest::RequestContextPrefetch: |
| 175 return "prefetch resource"; |
| 176 case WebURLRequest::RequestContextScript: |
| 177 return "script"; |
| 178 case WebURLRequest::RequestContextServiceWorker: |
| 179 return "Service Worker script"; |
| 180 case WebURLRequest::RequestContextSharedWorker: |
| 181 return "Shared Worker script"; |
| 182 case WebURLRequest::RequestContextStyle: |
| 183 return "stylesheet"; |
| 184 case WebURLRequest::RequestContextSubresource: |
| 185 return "resource"; |
| 186 case WebURLRequest::RequestContextTrack: |
| 187 return "Text Track"; |
| 188 case WebURLRequest::RequestContextUnspecified: |
| 189 return "resource"; |
| 190 case WebURLRequest::RequestContextVideo: |
| 191 return "video"; |
| 192 case WebURLRequest::RequestContextWorker: |
| 193 return "Worker script"; |
| 194 case WebURLRequest::RequestContextXMLHttpRequest: |
| 195 return "XMLHttpRequest endpoint"; |
| 196 case WebURLRequest::RequestContextXSLT: |
| 197 return "XSLT"; |
| 198 } |
| 199 ASSERT_NOT_REACHED(); |
| 200 return "resource"; |
| 201 } |
| 202 |
| 203 // static |
| 204 void MixedContentChecker::logToConsole(LocalFrame* frame, const KURL& url, WebUR
LRequest::RequestContext requestContext, bool allowed) |
| 205 { |
| 206 String message = String::format( |
| 207 "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an
insecure %s '%s'. %s", |
| 208 frame->document()->url().elidedString().utf8().data(), typeNameFromConte
xt(requestContext), url.elidedString().utf8().data(), |
| 209 allowed ? "This content should also be served over HTTPS." : "This reque
st has been blocked; the content must be served over HTTPS."); |
| 210 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; |
| 211 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message)); |
| 212 } |
| 213 |
| 214 // static |
127 bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
est& resourceRequest, const KURL& url) | 215 bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
est& resourceRequest, const KURL& url) |
128 { | 216 { |
129 // No frame, no mixed content: | 217 // No frame, no mixed content: |
130 if (!frame) | 218 if (!frame) |
131 return false; | 219 return false; |
132 | 220 |
133 // Check the top frame first. | 221 // Check the top frame first. |
134 if (Frame* top = frame->tree().top()) { | 222 if (Frame* top = frame->tree().top()) { |
135 // FIXME: We need a way to access the top-level frame's SecurityOrigin w
hen that frame | 223 // FIXME: We need a way to access the top-level frame's SecurityOrigin w
hen that frame |
136 // is in a different process from the current frame. Until that is done,
we bail out | 224 // is in a different process from the current frame. Until that is done,
we bail out |
(...skipping 12 matching lines...) Expand all Loading... |
149 | 237 |
150 // No mixed content, no problem. | 238 // No mixed content, no problem. |
151 if (!isMixedContent(frame->document()->securityOrigin(), url)) | 239 if (!isMixedContent(frame->document()->securityOrigin(), url)) |
152 return false; | 240 return false; |
153 | 241 |
154 Settings* settings = frame->settings(); | 242 Settings* settings = frame->settings(); |
155 FrameLoaderClient* client = frame->loader().client(); | 243 FrameLoaderClient* client = frame->loader().client(); |
156 SecurityOrigin* securityOrigin = frame->document()->securityOrigin(); | 244 SecurityOrigin* securityOrigin = frame->document()->securityOrigin(); |
157 bool allowed = false; | 245 bool allowed = false; |
158 | 246 |
159 switch (contextTypeFromContext(resourceRequest.requestContext())) { | 247 ContextType contextType = contextTypeFromContext(resourceRequest.requestCont
ext()); |
| 248 if (contextType == ContextTypeBlockableUnlessLax) |
| 249 contextType = RuntimeEnabledFeatures::laxMixedContentCheckingEnabled() ?
ContextTypeOptionallyBlockable : ContextTypeBlockable; |
| 250 |
| 251 switch (contextType) { |
160 case ContextTypeOptionallyBlockable: | 252 case ContextTypeOptionallyBlockable: |
161 allowed = client->allowDisplayingInsecureContent(settings && settings->a
llowDisplayOfInsecureContent(), securityOrigin, url); | 253 allowed = client->allowDisplayingInsecureContent(settings && settings->a
llowDisplayOfInsecureContent(), securityOrigin, url); |
162 if (allowed) | 254 if (allowed) |
163 client->didDisplayInsecureContent(); | 255 client->didDisplayInsecureContent(); |
164 return !allowed; | 256 break; |
165 | 257 |
166 case ContextTypeBlockable: | 258 case ContextTypeBlockable: |
167 allowed = client->allowRunningInsecureContent(settings && settings->allo
wRunningOfInsecureContent(), securityOrigin, url); | 259 allowed = client->allowRunningInsecureContent(settings && settings->allo
wRunningOfInsecureContent(), securityOrigin, url); |
168 if (allowed) | 260 if (allowed) |
169 client->didRunInsecureContent(securityOrigin, url); | 261 client->didRunInsecureContent(securityOrigin, url); |
170 return !allowed; | 262 break; |
171 | |
172 case ContextTypeBlockableUnlessLax: | |
173 if (RuntimeEnabledFeatures::laxMixedContentCheckingEnabled()) { | |
174 allowed = client->allowDisplayingInsecureContent(settings && setting
s->allowDisplayOfInsecureContent(), securityOrigin, url); | |
175 if (allowed) | |
176 client->didDisplayInsecureContent(); | |
177 } else { | |
178 allowed = client->allowRunningInsecureContent(settings && settings->
allowRunningOfInsecureContent(), securityOrigin, url); | |
179 if (allowed) | |
180 client->didRunInsecureContent(securityOrigin, url); | |
181 } | |
182 return !allowed; | |
183 | 263 |
184 case ContextTypeShouldBeBlockable: | 264 case ContextTypeShouldBeBlockable: |
185 return false; | 265 return false; |
| 266 |
| 267 case ContextTypeBlockableUnlessLax: |
| 268 // We map this to either OptionallyBlockable or Blockable above. |
| 269 ASSERT_NOT_REACHED(); |
| 270 return true; |
186 }; | 271 }; |
187 ASSERT_NOT_REACHED(); | 272 |
188 return true; | 273 logToConsole(frame, url, resourceRequest.requestContext(), allowed); |
| 274 return !allowed; |
189 } | 275 } |
190 | 276 |
191 bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
rityOrigin, const KURL& url, const MixedContentType type) const | 277 bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
rityOrigin, const KURL& url, const MixedContentType type) const |
192 { | 278 { |
193 // Check the top frame if it differs from MixedContentChecker's m_frame. | 279 // Check the top frame if it differs from MixedContentChecker's m_frame. |
194 if (!m_frame->tree().top()->isLocalFrame()) { | 280 if (!m_frame->tree().top()->isLocalFrame()) { |
195 // FIXME: We need a way to access the top-level frame's MixedContentChec
ker when that frame | 281 // FIXME: We need a way to access the top-level frame's MixedContentChec
ker when that frame |
196 // is in a different process from the current frame. Until that is done,
we always allow | 282 // is in a different process from the current frame. Until that is done,
we always allow |
197 // loads in remote frames. | 283 // loads in remote frames. |
198 return false; | 284 return false; |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
299 break; | 385 break; |
300 case Submission: | 386 case Submission: |
301 message.append("is submitting data to an insecure location at '" + targe
t.elidedString() + "': this content should also be submitted over HTTPS.\n"); | 387 message.append("is submitting data to an insecure location at '" + targe
t.elidedString() + "': this content should also be submitted over HTTPS.\n"); |
302 break; | 388 break; |
303 } | 389 } |
304 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; | 390 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; |
305 m_frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessag
eSource, messageLevel, message.toString())); | 391 m_frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessag
eSource, messageLevel, message.toString())); |
306 } | 392 } |
307 | 393 |
308 } // namespace blink | 394 } // namespace blink |
OLD | NEW |