Mixed Content: Make strict mode stricter.

Source/core/loader/MixedContentChecker.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 311 matching lines @@
             client->didDisplayInsecureContent();
         break;
 
     case ContextTypeBlockable:
         allowed = !strictMode && client->allowRunningInsecureContent(settings && settings->allowRunningOfInsecureContent(), securityOrigin, url);
         if (allowed)
             client->didRunInsecureContent(securityOrigin, url);
         break;
 
     case ContextTypeShouldBeBlockable:
-        allowed = true;
-        client->didDisplayInsecureContent();
+        allowed = !strictMode && true;

[jww, 2015/02/23 18:23:17]

Why the '&& true'? Shouldn't !strictMode be sufficient?

[Mike West, 2015/02/24 07:43:34]

Because I'm an idiot. Thanks!

+        if (allowed)
+            client->didDisplayInsecureContent();
         break;
     };
 
     if (reportingStatus == SendReport)
         logToConsole(frame, url, requestContext, allowed);
     return !allowed;
 }
 
 // static
 bool MixedContentChecker::shouldBlockConnection(LocalFrame* frame, const KURL& url, MixedContentChecker::ReportingStatus reportingStatus)
 {
     LocalFrame* mixedFrame = inWhichFrameIsContentMixed(frame, WebURLRequest::FrameTypeNone, url);
     if (!mixedFrame)
         return false;
 
     UseCounter::count(mixedFrame, UseCounter::MixedContentPresent);
     UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket);
 
-    // If we're in strict mode, we'll automagically fail everything, and intentionally skip
-    // the client checks in order to prevent degrading the site's security UI.
-    bool strictMode = mixedFrame->document()->shouldEnforceStrictMixedContentChecking();
-
     Settings* settings = mixedFrame->settings();
     FrameLoaderClient* client = mixedFrame->loader().client();
     SecurityOrigin* securityOrigin = mixedFrame->document()->securityOrigin();
-    bool allowedPerSettings = settings && (settings->allowRunningOfInsecureContent() || settings->allowConnectingInsecureWebSocket());
+
+    // If we're in strict mode, we'll automagically fail everything, and intentionally skip
+    // the client checks in order to prevent degrading the site's security UI.
+    bool strictMode = mixedFrame->document()->shouldEnforceStrictMixedContentChecking() || settings->strictMixedContentChecking();
+    bool allowedPerSettings = !strictMode && settings && (settings->allowRunningOfInsecureContent() || settings->allowConnectingInsecureWebSocket());
     bool allowed = !strictMode && client->allowRunningInsecureContent(allowedPerSettings, securityOrigin, url);
 
     if (reportingStatus == SendReport) {
         String message = String::format(
             "Mixed Content: The page at '%s' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint '%s'. %s",
             frame->document()->url().elidedString().utf8().data(), url.elidedString().utf8().data(),
             allowed ? "This endpoint should be available via WSS. Insecure access is deprecated." : "This request has been blocked; this endpoint must be available over WSS.");
         MessageLevel messageLevel = allowed ? WarningMessageLevel : ErrorMessageLevel;
         mixedFrame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, messageLevel, message));
     }
@@ skipping 31 matching lines @@
 {
     if (!frame || !frame->document() || !frame->document()->loader())
         return;
 
     // Just count these for the moment, don't block them.
     if (Platform::current()->isReservedIPAddress(resourceIPAddress) && !frame->document()->isHostedInReservedIPRange())
         UseCounter::count(frame->document(), UseCounter::MixedContentPrivateHostnameInPublicHostname);
 }
 
 } // namespace blink