OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2012 Google Inc. All rights reserved. | 2 * Copyright (C) 2012 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * | 7 * |
8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
(...skipping 195 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
206 { | 206 { |
207 String message = String::format( | 207 String message = String::format( |
208 "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an
insecure %s '%s'. %s", | 208 "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an
insecure %s '%s'. %s", |
209 frame->document()->url().elidedString().utf8().data(), typeNameFromConte
xt(requestContext), url.elidedString().utf8().data(), | 209 frame->document()->url().elidedString().utf8().data(), typeNameFromConte
xt(requestContext), url.elidedString().utf8().data(), |
210 allowed ? "This content should also be served over HTTPS." : "This reque
st has been blocked; the content must be served over HTTPS."); | 210 allowed ? "This content should also be served over HTTPS." : "This reque
st has been blocked; the content must be served over HTTPS."); |
211 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; | 211 MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLeve
l; |
212 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message)); | 212 frame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageS
ource, messageLevel, message)); |
213 } | 213 } |
214 | 214 |
215 // static | 215 // static |
216 bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
est& resourceRequest, const KURL& url) | 216 bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
est& resourceRequest, const KURL& url, MixedContentChecker::ReportingStatus repo
rtingStatus) |
217 { | 217 { |
218 // No frame, no mixed content: | 218 // No frame, no mixed content: |
219 if (!frame) | 219 if (!frame) |
220 return false; | 220 return false; |
221 | 221 |
222 // Check the top frame first. | 222 // Check the top frame first. |
223 if (Frame* top = frame->tree().top()) { | 223 if (Frame* top = frame->tree().top()) { |
224 // FIXME: We need a way to access the top-level frame's SecurityOrigin w
hen that frame | 224 // FIXME: We need a way to access the top-level frame's SecurityOrigin w
hen that frame |
225 // is in a different process from the current frame. Until that is done,
we bail out | 225 // is in a different process from the current frame. Until that is done,
we bail out |
226 // early and allow the load. | 226 // early and allow the load. |
227 if (!top->isLocalFrame()) | 227 if (!top->isLocalFrame()) |
228 return false; | 228 return false; |
229 | 229 |
230 LocalFrame* localTop = toLocalFrame(top); | 230 LocalFrame* localTop = toLocalFrame(top); |
231 if (frame != localTop && shouldBlockFetch(localTop, resourceRequest, url
)) | 231 if (frame != localTop && shouldBlockFetch(localTop, resourceRequest, url
, reportingStatus)) |
232 return true; | 232 return true; |
233 } | 233 } |
234 | 234 |
235 // We only care about subresource loads; top-level navigations cannot be mix
ed content. | 235 // We only care about subresource loads; top-level navigations cannot be mix
ed content. |
236 if (resourceRequest.frameType() == WebURLRequest::FrameTypeTopLevel) | 236 if (resourceRequest.frameType() == WebURLRequest::FrameTypeTopLevel) |
237 return false; | 237 return false; |
238 | 238 |
239 // No mixed content, no problem. | 239 // No mixed content, no problem. |
240 if (!isMixedContent(frame->document()->securityOrigin(), url)) | 240 if (!isMixedContent(frame->document()->securityOrigin(), url)) |
241 return false; | 241 return false; |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
273 | 273 |
274 case ContextTypeShouldBeBlockable: | 274 case ContextTypeShouldBeBlockable: |
275 return false; | 275 return false; |
276 | 276 |
277 case ContextTypeBlockableUnlessLax: | 277 case ContextTypeBlockableUnlessLax: |
278 // We map this to either OptionallyBlockable or Blockable above. | 278 // We map this to either OptionallyBlockable or Blockable above. |
279 ASSERT_NOT_REACHED(); | 279 ASSERT_NOT_REACHED(); |
280 return true; | 280 return true; |
281 }; | 281 }; |
282 | 282 |
283 logToConsole(frame, url, resourceRequest.requestContext(), allowed); | 283 if (reportingStatus == SendReport) |
| 284 logToConsole(frame, url, resourceRequest.requestContext(), allowed); |
284 return !allowed; | 285 return !allowed; |
285 } | 286 } |
286 | 287 |
287 bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
rityOrigin, const KURL& url, const MixedContentType type) const | 288 bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
rityOrigin, const KURL& url, const MixedContentType type) const |
288 { | 289 { |
289 // Check the top frame if it differs from MixedContentChecker's m_frame. | 290 // Check the top frame if it differs from MixedContentChecker's m_frame. |
290 if (!m_frame->tree().top()->isLocalFrame()) { | 291 if (!m_frame->tree().top()->isLocalFrame()) { |
291 // FIXME: We need a way to access the top-level frame's MixedContentChec
ker when that frame | 292 // FIXME: We need a way to access the top-level frame's MixedContentChec
ker when that frame |
292 // is in a different process from the current frame. Until that is done,
we always allow | 293 // is in a different process from the current frame. Until that is done,
we always allow |
293 // loads in remote frames. | 294 // loads in remote frames. |
(...skipping 121 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
415 if (Platform::current()->isReservedIPAddress(resourceIP) && !Platform::curre
nt()->isReservedIPAddress(documentIP)) | 416 if (Platform::current()->isReservedIPAddress(resourceIP) && !Platform::curre
nt()->isReservedIPAddress(documentIP)) |
416 UseCounter::count(frame->document(), UseCounter::MixedContentPrivateHost
nameInPublicHostname); | 417 UseCounter::count(frame->document(), UseCounter::MixedContentPrivateHost
nameInPublicHostname); |
417 } | 418 } |
418 | 419 |
419 void MixedContentChecker::trace(Visitor* visitor) | 420 void MixedContentChecker::trace(Visitor* visitor) |
420 { | 421 { |
421 visitor->trace(m_frame); | 422 visitor->trace(m_frame); |
422 } | 423 } |
423 | 424 |
424 } // namespace blink | 425 } // namespace blink |
OLD | NEW |