OLD | NEW |
1 /* | 1 /* |
2 Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de) | 2 Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de) |
3 Copyright (C) 2001 Dirk Mueller (mueller@kde.org) | 3 Copyright (C) 2001 Dirk Mueller (mueller@kde.org) |
4 Copyright (C) 2002 Waldo Bastian (bastian@kde.org) | 4 Copyright (C) 2002 Waldo Bastian (bastian@kde.org) |
5 Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
rights reserved. | 5 Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
rights reserved. |
6 Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/ | 6 Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/ |
7 | 7 |
8 This library is free software; you can redistribute it and/or | 8 This library is free software; you can redistribute it and/or |
9 modify it under the terms of the GNU Library General Public | 9 modify it under the terms of the GNU Library General Public |
10 License as published by the Free Software Foundation; either | 10 License as published by the Free Software Foundation; either |
(...skipping 868 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
879 return; | 879 return; |
880 | 880 |
881 KURL url = fetchRequest.resourceRequest().url(); | 881 KURL url = fetchRequest.resourceRequest().url(); |
882 | 882 |
883 // Tack a 'Prefer' header to outgoing navigational requests, as described in | 883 // Tack a 'Prefer' header to outgoing navigational requests, as described in |
884 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect | 884 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect |
885 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne && !SecurityOrigin::isSecure(url)) | 885 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne && !SecurityOrigin::isSecure(url)) |
886 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Prefer", "retu
rn=secure-representation"); | 886 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Prefer", "retu
rn=secure-representation"); |
887 | 887 |
888 if (document()->insecureRequestsPolicy() == SecurityContext::InsecureRequest
sUpgrade && url.protocolIs("http")) { | 888 if (document()->insecureRequestsPolicy() == SecurityContext::InsecureRequest
sUpgrade && url.protocolIs("http")) { |
889 // We always upgrade subresource requests and nested frames, we always u
pgrade form | 889 const ResourceRequest& request = fetchRequest.resourceRequest(); |
890 // submissions, and we always upgrade requests whose host matches the ho
st of the | 890 |
891 // containing document's security origin. | 891 // We always upgrade requests that meet any of the following criteria: |
892 // | 892 // |
893 // FIXME: We need to check the document that set the policy, not the cur
rent document. | 893 // 1. Are for subresources (including nested frames). |
894 const ResourceRequest& request = fetchRequest.resourceRequest(); | 894 // 2. Are form submissions. |
| 895 // 3. Whose hosts are contained in the document's InsecureNavigationSet. |
895 if (request.frameType() == WebURLRequest::FrameTypeNone | 896 if (request.frameType() == WebURLRequest::FrameTypeNone |
896 || request.frameType() == WebURLRequest::FrameTypeNested | 897 || request.frameType() == WebURLRequest::FrameTypeNested |
897 || request.requestContext() == WebURLRequest::RequestContextForm | 898 || request.requestContext() == WebURLRequest::RequestContextForm |
898 || url.host() == document()->securityOrigin()->host()) | 899 || document()->insecureNavigationsToUpgrade()->contains(url.host().i
mpl()->hash())) |
899 { | 900 { |
900 url.setProtocol("https"); | 901 url.setProtocol("https"); |
901 if (url.port() == 80) | 902 if (url.port() == 80) |
902 url.setPort(443); | 903 url.setPort(443); |
903 fetchRequest.mutableResourceRequest().setURL(url); | 904 fetchRequest.mutableResourceRequest().setURL(url); |
904 } | 905 } |
905 } | 906 } |
906 } | 907 } |
907 | 908 |
908 void ResourceFetcher::addClientHintsIfNeccessary(FetchRequest& fetchRequest) | 909 void ResourceFetcher::addClientHintsIfNeccessary(FetchRequest& fetchRequest) |
(...skipping 728 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1637 ResourceLoaderHost::trace(visitor); | 1638 ResourceLoaderHost::trace(visitor); |
1638 } | 1639 } |
1639 | 1640 |
1640 ResourceFetcher* ResourceFetcher::toResourceFetcher(ResourceLoaderHost* host) | 1641 ResourceFetcher* ResourceFetcher::toResourceFetcher(ResourceLoaderHost* host) |
1641 { | 1642 { |
1642 ASSERT(host->objectType() == ResourceLoaderHost::ResourceFetcherType); | 1643 ASSERT(host->objectType() == ResourceLoaderHost::ResourceFetcherType); |
1643 return static_cast<ResourceFetcher*>(host); | 1644 return static_cast<ResourceFetcher*>(host); |
1644 } | 1645 } |
1645 | 1646 |
1646 } | 1647 } |
OLD | NEW |