Skip to content

GitLab

T
tangled
Commit 78efd70d authored by jww@chromium.org's avatar jww@chromium.org
Browse files
Options

Removal of getUserMedia() on insecure origins 

This disallows getUserMedia() from being used on insecure origins. Adds
a console warning message that the API call has failed because of this.

BUG=520765

Review URL: https://codereview.chromium.org/1284193003

git-svn-id: svn://svn.chromium.org/blink/trunk@200986 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 22420972
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 47 deletions
third_party/WebKit/LayoutTests/http/tests/security/powerfulFeatureRestrictions/getUserMedia-on-insecure-origin.html deleted 100644 → 0
View file @ 22420972
<!DOCTYPE html>
<title>getUserMedia On An Insecure Origin</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/get-host-info.js"></script>
<script>
if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
window.location = get_host_info().UNAUTHENTICATED_ORIGIN + window.location.pathname;
} else {
if (window.testRunner)
testRunner.overridePreference("WebKitStrictPowerfulFeatureRestrictions", true);
test(function () {
assert_throws(
"SecurityError",
function() {
navigator.webkitGetUserMedia(
{ video:true },
function() { assert_unreached("Success callback should not be called."); },
function() { assert_unreached("Error callback should not be called."); });
});
}, 'getUserMedia');
}
</script>
third_party/WebKit/LayoutTests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin-expected.txt
View file @ 78efd70d
CONSOLE WARNING: getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details. CONSOLE WARNING: getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: requestFullscreen() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details. CONSOLE WARNING: requestFullscreen() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: getUserMedia() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: The devicemotion event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details. CONSOLE WARNING: The devicemotion event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: The deviceorientation event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details. CONSOLE WARNING: The deviceorientation event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: getUserMedia() no longer works on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
CONSOLE WARNING: requestMediaKeySystemAccess() is deprecated on insecure origins in the specification. Support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details. CONSOLE WARNING: requestMediaKeySystemAccess() is deprecated on insecure origins in the specification. Support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
This is a testharness.js-based test. This is a testharness.js-based test.
PASS getCurrentPosition PASS getCurrentPosition
PASS watchPosition PASS watchPosition
PASS fullscreen PASS fullscreen
PASS getUserMedia
PASS device motion PASS device motion
PASS device orientation PASS device orientation
PASS requestMediaKeySystemAccess PASS requestMediaKeySystemAccess
PASS getUserMedia
Harness: the test ran to completion. Harness: the test ran to completion.
third_party/WebKit/LayoutTests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin.html
View file @ 78efd70d
...@@ -27,6 +27,8 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) { ...@@ -27,6 +27,8 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
mockLongitude, mockLongitude,
mockAccuracy); mockAccuracy);
// Tests for APIs that are deprecated, but still allowed, on
// insecure origins
async_test(function() { async_test(function() {
navigator.geolocation.getCurrentPosition( navigator.geolocation.getCurrentPosition(
this.step_func(function() { this.step_func(function() {
...@@ -69,17 +71,6 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) { ...@@ -69,17 +71,6 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
document.removeEventListener("click", request); document.removeEventListener("click", request);
}, 'fullscreen'); }, 'fullscreen');
async_test(function() {
navigator.webkitGetUserMedia({ audio: true, video: true },
this.step_func(function() {
this.done();
}),
this.step_func(function() {
assert_unreached('getUserMedia should succeed, but failed.');
this.done();
}));
}, 'getUserMedia');
async_test(function() { async_test(function() {
testRunner.setMockDeviceMotion(true, 0, true, 0, true, 0, testRunner.setMockDeviceMotion(true, 0, true, 0, true, 0,
true, 0, true, 0, true, 0, true, 0, true, 0, true, 0,
...@@ -102,6 +93,13 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) { ...@@ -102,6 +93,13 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
promise_test(function(test) { promise_test(function(test) {
return navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{}]); return navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{}]);
}, 'requestMediaKeySystemAccess'); }, 'requestMediaKeySystemAccess');
// Tests for APIs that have been turned off on insecure origins
async_test(function() {
navigator.webkitGetUserMedia({ audio: true, video: true },
this.unreached_func('getUserMedia should call the error callback, but called the success callback instead.'),
this.step_func_done());
}, 'getUserMedia');
} }
</script> </script>
</body> </body>
......
third_party/WebKit/Source/core/frame/UseCounter.cpp
View file @ 78efd70d
...@@ -887,7 +887,7 @@ String UseCounter::deprecationMessage(Feature feature) ...@@ -887,7 +887,7 @@ String UseCounter::deprecationMessage(Feature feature)
return "getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details."; return "getCurrentPosition() and watchPosition() are deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.";
case GetUserMediaInsecureOrigin: case GetUserMediaInsecureOrigin:
return "getUserMedia() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details."; return "getUserMedia() no longer works on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.";
case FullscreenInsecureOrigin: case FullscreenInsecureOrigin:
return "requestFullscreen() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details."; return "requestFullscreen() is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.";
......
third_party/WebKit/Source/modules/mediastream/NavigatorMediaStream.cpp
View file @ 78efd70d
...@@ -62,21 +62,19 @@ void NavigatorMediaStream::webkitGetUserMedia(Navigator& navigator, const MediaS ...@@ -62,21 +62,19 @@ void NavigatorMediaStream::webkitGetUserMedia(Navigator& navigator, const MediaS
return; return;
} }
UserMediaRequest* request = UserMediaRequest::create(navigator.frame()->document(), userMedia, options, successCallback, errorCallback, exceptionState);
if (!request) {
ASSERT(exceptionState.hadException());
return;
}
String errorMessage; String errorMessage;
if (navigator.frame()->document()->isPrivilegedContext(errorMessage)) { if (navigator.frame()->document()->isPrivilegedContext(errorMessage)) {
UseCounter::count(navigator.frame(), UseCounter::GetUserMediaSecureOrigin); UseCounter::count(navigator.frame(), UseCounter::GetUserMediaSecureOrigin);
} else { } else {
UseCounter::countDeprecation(navigator.frame(), UseCounter::GetUserMediaInsecureOrigin); UseCounter::countDeprecation(navigator.frame(), UseCounter::GetUserMediaInsecureOrigin);
OriginsUsingFeatures::countAnyWorld(*navigator.frame()->document(), OriginsUsingFeatures::Feature::GetUserMediaInsecureOrigin); OriginsUsingFeatures::countAnyWorld(*navigator.frame()->document(), OriginsUsingFeatures::Feature::GetUserMediaInsecureOrigin);
if (navigator.frame()->settings()->strictPowerfulFeatureRestrictions()) { request->failPermissionDenied(errorMessage);
exceptionState.throwSecurityError(ExceptionMessages::failedToExecute("webkitGetUserMedia", "Navigator", errorMessage));
return;
}
}
UserMediaRequest* request = UserMediaRequest::create(navigator.frame()->document(), userMedia, options, successCallback, errorCallback, exceptionState);
if (!request) {
ASSERT(exceptionState.hadException());
return; return;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment