Mixed Content: Migrate ResourceFetcher to the static mixed content checker.

Source/core/loader/MixedContentChecker.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 91 matching lines @@
     case WebURLRequest::RequestContextTrack:
     case WebURLRequest::RequestContextWorker:
     case WebURLRequest::RequestContextXSLT:
         return ContextTypeBlockable;
 
     // "Blockable" mixed content whose behavior changed recently, and which is thus guarded behind the "lax" flag
     case WebURLRequest::RequestContextEventSource:
     case WebURLRequest::RequestContextXMLHttpRequest:
         return ContextTypeBlockableUnlessLax;
 
-    // Contexts that we should block, but don't currently.
+    // FIXME: Contexts that we should block, but don't currently. https://crbug.com/388650
     case WebURLRequest::RequestContextDownload:
     case WebURLRequest::RequestContextInternal:
     case WebURLRequest::RequestContextPlugin:
     case WebURLRequest::RequestContextPrefetch:
         return ContextTypeShouldBeBlockable;
 
     case WebURLRequest::RequestContextUnspecified:
         ASSERT_NOT_REACHED();
     }
     ASSERT_NOT_REACHED();
     return ContextTypeBlockable;
 }
 
 // static
+const char* MixedContentChecker::typeNameFromContext(WebURLRequest::RequestContext context)
+{
+    switch (context) {
+    case WebURLRequest::RequestContextAudio:
+        return "audio file";
+    case WebURLRequest::RequestContextBeacon:
+        return "Beacon endpoint";
+    case WebURLRequest::RequestContextCSPReport:
+        return "Content Security Policy reporting endpoint";
+    case WebURLRequest::RequestContextDownload:
+        return "download";
+    case WebURLRequest::RequestContextEmbed:
+        return "plugin resource";
+    case WebURLRequest::RequestContextEventSource:
+        return "EventSource endpoint";
+    case WebURLRequest::RequestContextFavicon:
+        return "favicon";
+    case WebURLRequest::RequestContextFetch:
+        return "resource";
+    case WebURLRequest::RequestContextFont:
+        return "font";
+    case WebURLRequest::RequestContextForm:
+        return "form action";
+    case WebURLRequest::RequestContextFrame:
+        return "frame";
+    case WebURLRequest::RequestContextHyperlink:
+        return "resource";
+    case WebURLRequest::RequestContextIframe:
+        return "frame";
+    case WebURLRequest::RequestContextImage:
+        return "image";
+    case WebURLRequest::RequestContextImageSet:
+        return "image";
+    case WebURLRequest::RequestContextImport:
+        return "HTML Import";
+    case WebURLRequest::RequestContextInternal:
+        return "resource";
+    case WebURLRequest::RequestContextLocation:
+        return "resource";
+    case WebURLRequest::RequestContextManifest:
+        return "manifest";
+    case WebURLRequest::RequestContextObject:
+        return "plugin resource";
+    case WebURLRequest::RequestContextPing:
+        return "hyperlink auditing endpoint";
+    case WebURLRequest::RequestContextPlugin:
+        return "plugin data";
+    case WebURLRequest::RequestContextPrefetch:
+        return "prefetch resource";
+    case WebURLRequest::RequestContextScript:
+        return "script";
+    case WebURLRequest::RequestContextServiceWorker:
+        return "Service Worker script";
+    case WebURLRequest::RequestContextSharedWorker:
+        return "Shared Worker script";
+    case WebURLRequest::RequestContextStyle:
+        return "stylesheet";
+    case WebURLRequest::RequestContextSubresource:
+        return "resource";
+    case WebURLRequest::RequestContextTrack:
+        return "Text Track";
+    case WebURLRequest::RequestContextUnspecified:
+        return "resource";
+    case WebURLRequest::RequestContextVideo:
+        return "video";
+    case WebURLRequest::RequestContextWorker:
+        return "Worker script";
+    case WebURLRequest::RequestContextXMLHttpRequest:
+        return "XMLHttpRequest endpoint";
+    case WebURLRequest::RequestContextXSLT:
+        return "XSLT";
+    }
+    ASSERT_NOT_REACHED();
+    return "resource";
+}
+
+// static
+void MixedContentChecker::logToConsole(LocalFrame* frame, const KURL& url, WebURLRequest::RequestContext requestContext, bool allowed)
+{
+    String message = String::format(
+        "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an insecure %s '%s'. %s",
+        frame->document()->url().elidedString().utf8().data(), typeNameFromContext(requestContext), url.elidedString().utf8().data(),
+        allowed ? "This content should also be served over HTTPS." : "This request has been blocked; the content must be served over HTTPS.");
+    MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLevel;
+    frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, messageLevel, message));
+}
+
+// static
 bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequest& resourceRequest, const KURL& url)
 {
     // No frame, no mixed content:
     if (!frame)
         return false;
 
     // Check the top frame first.
     if (Frame* top = frame->tree().top()) {
         // FIXME: We need a way to access the top-level frame's SecurityOrigin when that frame
         // is in a different process from the current frame. Until that is done, we bail out
@@ skipping 12 matching lines @@
 
     // No mixed content, no problem.
     if (!isMixedContent(frame->document()->securityOrigin(), url))
         return false;
 
     Settings* settings = frame->settings();
     FrameLoaderClient* client = frame->loader().client();
     SecurityOrigin* securityOrigin = frame->document()->securityOrigin();
     bool allowed = false;
 
-    switch (contextTypeFromContext(resourceRequest.requestContext())) {
+    ContextType contextType = contextTypeFromContext(resourceRequest.requestContext());
+    if (contextType == ContextTypeBlockableUnlessLax)
+        contextType = RuntimeEnabledFeatures::laxMixedContentCheckingEnabled() ? ContextTypeOptionallyBlockable : ContextTypeBlockable;
+
+    switch (contextType) {
     case ContextTypeOptionallyBlockable:
         allowed = client->allowDisplayingInsecureContent(settings && settings->allowDisplayOfInsecureContent(), securityOrigin, url);
         if (allowed)
             client->didDisplayInsecureContent();
-        return !allowed;
+        break;
 
     case ContextTypeBlockable:
         allowed = client->allowRunningInsecureContent(settings && settings->allowRunningOfInsecureContent(), securityOrigin, url);
         if (allowed)
             client->didRunInsecureContent(securityOrigin, url);
-        return !allowed;
-
-    case ContextTypeBlockableUnlessLax:
-        if (RuntimeEnabledFeatures::laxMixedContentCheckingEnabled()) {
-            allowed = client->allowDisplayingInsecureContent(settings && settings->allowDisplayOfInsecureContent(), securityOrigin, url);
-            if (allowed)
-                client->didDisplayInsecureContent();
-        } else {
-            allowed = client->allowRunningInsecureContent(settings && settings->allowRunningOfInsecureContent(), securityOrigin, url);
-            if (allowed)
-                client->didRunInsecureContent(securityOrigin, url);
-        }
-        return !allowed;
+        break;
 
     case ContextTypeShouldBeBlockable:
         return false;
+
+    case ContextTypeBlockableUnlessLax:
+        // We map this to either OptionallyBlockable or Blockable above.
+        ASSERT_NOT_REACHED();
+        return true;
     };
-    ASSERT_NOT_REACHED();
-    return true;
+
+    logToConsole(frame, url, resourceRequest.requestContext(), allowed);
+    return !allowed;
 }
 
 bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* securityOrigin, const KURL& url, const MixedContentType type) const
 {
     // Check the top frame if it differs from MixedContentChecker's m_frame.
     if (!m_frame->tree().top()->isLocalFrame()) {
         // FIXME: We need a way to access the top-level frame's MixedContentChecker when that frame
         // is in a different process from the current frame. Until that is done, we always allow
         // loads in remote frames.
         return false;
@@ skipping 100 matching lines @@
         break;
     case Submission:
         message.append("is submitting data to an insecure location at '" + target.elidedString() + "': this content should also be submitted over HTTPS.\n");
         break;
     }
     MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLevel;
     m_frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, messageLevel, message.toString()));
 }
 
 } // namespace blink