Skip to content

GitLab

T
tangled
Commit 6b4d2027 authored by kouhei@chromium.org's avatar kouhei@chromium.org
Browse files
Options

MixedContentChecker should not log blocked preload requests 

This CL adds a SuppressLog argument to MixedContentChecker::shouldBlockFetch to suppress logging for preload requests.
This makes it consistent with content security policy checks which also do not warn on preload requests.

BUG=432771

Review URL: https://codereview.chromium.org/726563004

git-svn-id: svn://svn.chromium.org/blink/trunk@185420 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 063f2160
Hide whitespace changes
Inline Side-by-side
Showing with 48 additions and 8 deletions
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/preload-insecure-image-in-main-frame-blocked-expected.txt 0 → 100644
View file @ 6b4d2027
CONSOLE ERROR: line 2: Mixed Content: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-preloads-insecure-image.html' was loaded over HTTPS, but requested an insecure image 'http://127.0.0.1:8080/security/resources/compass.jpg'. This request has been blocked; the content must be served over HTTPS.
This test opens a window that loads an insecure image. We should not trigger a mixed content callback even though the main frame in the window is HTTPS and is displaying insecure content, because we've set the preference to block this.
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/preload-insecure-image-in-main-frame-blocked.html 0 → 100644
View file @ 6b4d2027
<html>
<body>
<script>
if (window.testRunner) {
testRunner.waitUntilDone();
testRunner.dumpAsText();
testRunner.setCanOpenWindows();
testRunner.setCloseRemainingWindowsWhenComplete(true);
testRunner.overridePreference("WebKitAllowDisplayingInsecureContent", false);
}
window.addEventListener("message", function (e) {
if (window.testRunner)
testRunner.notifyDone();
}, false);
</script>
<p>This test opens a window that loads an insecure image. We should not
trigger a mixed content callback even though the main frame in the window
is HTTPS and is displaying insecure content, because we've set the preference
to block this.</p>
<script>
window.open("https://127.0.0.1:8443/security/mixedContent/resources/frame-preloads-insecure-image.html");
</script>
</body>
</html>
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/resources/frame-preloads-insecure-image.html 0 → 100644
View file @ 6b4d2027
<script src="https://127.0.0.1:8080/resources/slow-script.pl?delay=3000"></script>
<img src="http://127.0.0.1:8080/security/resources/compass.jpg">
<script>
window.onload = function() {
if (window.opener)
window.opener.postMessage('done', '*');
};
</script>
third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
View file @ 6b4d2027
...@@ -591,7 +591,9 @@ bool ResourceFetcher::canRequest(Resource::Type type, const ResourceRequest& res ...@@ -591,7 +591,9 @@ bool ResourceFetcher::canRequest(Resource::Type type, const ResourceRequest& res
effectiveFrame = toLocalFrame(frame()->tree().parent()); effectiveFrame = toLocalFrame(frame()->tree().parent());
} }
return !MixedContentChecker::shouldBlockFetch(effectiveFrame, resourceRequest, url); MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ?
MixedContentChecker::SuppressReport : MixedContentChecker::SendReport;
return !MixedContentChecker::shouldBlockFetch(effectiveFrame, resourceRequest, url, mixedContentReporting);
} }
bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url) const bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url) const
...@@ -674,7 +676,8 @@ void ResourceFetcher::maybeNotifyInsecureContent(const Resource* resource) const ...@@ -674,7 +676,8 @@ void ResourceFetcher::maybeNotifyInsecureContent(const Resource* resource) const
// As a side effect browser will be notified. // As a side effect browser will be notified.
MixedContentChecker::shouldBlockFetch(frame(), MixedContentChecker::shouldBlockFetch(frame(),
resource->lastResourceRequest(), resource->lastResourceRequest(),
resource->lastResourceRequest().url()); resource->lastResourceRequest().url(),
MixedContentChecker::SendReport);
} }
// Limit the number of URLs in m_validatedURLs to avoid memory bloat. // Limit the number of URLs in m_validatedURLs to avoid memory bloat.
...@@ -1261,8 +1264,7 @@ void ResourceFetcher::preload(Resource::Type type, FetchRequest& request, const ...@@ -1261,8 +1264,7 @@ void ResourceFetcher::preload(Resource::Type type, FetchRequest& request, const
// Loading images involves several special cases, so use dedicated fetch method instead. // Loading images involves several special cases, so use dedicated fetch method instead.
if (type == Resource::Image) if (type == Resource::Image)
resource = fetchImage(request); resource = fetchImage(request);
else
if (!resource)
resource = requestResource(type, request); resource = requestResource(type, request);
if (!resource || (m_preloads && m_preloads->contains(resource.get()))) if (!resource || (m_preloads && m_preloads->contains(resource.get())))
return; return;
......
third_party/WebKit/Source/core/loader/MixedContentChecker.cpp
View file @ 6b4d2027
...@@ -213,7 +213,7 @@ void MixedContentChecker::logToConsole(LocalFrame* frame, const KURL& url, WebUR ...@@ -213,7 +213,7 @@ void MixedContentChecker::logToConsole(LocalFrame* frame, const KURL& url, WebUR
} }
// static // static
bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequest& resourceRequest, const KURL& url) bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequest& resourceRequest, const KURL& url, MixedContentChecker::ReportingStatus reportingStatus)
{ {
// No frame, no mixed content: // No frame, no mixed content:
if (!frame) if (!frame)
...@@ -228,7 +228,7 @@ bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ ...@@ -228,7 +228,7 @@ bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
return false; return false;
LocalFrame* localTop = toLocalFrame(top); LocalFrame* localTop = toLocalFrame(top);
if (frame != localTop && shouldBlockFetch(localTop, resourceRequest, url)) if (frame != localTop && shouldBlockFetch(localTop, resourceRequest, url, reportingStatus))
return true; return true;
} }
...@@ -280,7 +280,8 @@ bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ ...@@ -280,7 +280,8 @@ bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, const ResourceRequ
return true; return true;
}; };
logToConsole(frame, url, resourceRequest.requestContext(), allowed); if (reportingStatus == SendReport)
logToConsole(frame, url, resourceRequest.requestContext(), allowed);
return !allowed; return !allowed;
} }
......
third_party/WebKit/Source/core/loader/MixedContentChecker.h
View file @ 6b4d2027
...@@ -48,7 +48,8 @@ class MixedContentChecker final { ...@@ -48,7 +48,8 @@ class MixedContentChecker final {
public: public:
explicit MixedContentChecker(LocalFrame*); explicit MixedContentChecker(LocalFrame*);
static bool shouldBlockFetch(LocalFrame*, const ResourceRequest&, const KURL&); enum ReportingStatus { SendReport, SuppressReport };
static bool shouldBlockFetch(LocalFrame*, const ResourceRequest&, const KURL&, ReportingStatus);
bool canDisplayInsecureContent(SecurityOrigin* securityOrigin, const KURL& url) const bool canDisplayInsecureContent(SecurityOrigin* securityOrigin, const KURL& url) const
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment