Commit 7b10173c authored by Carlos IL's avatar Carlos IL Committed by Commit Bot

Added opt out for mixed content autouptrade experiment.

Bug: 894513
Change-Id: Ic1d07c820cfce2aa4eae54a54e748fd0450ca7ab
Reviewed-on: https://chromium-review.googlesource.com/c/1347797Reviewed-by: default avatarMike West <mkwst@chromium.org>
Commit-Queue: Carlos IL <carlosil@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611868}
parent 2e348902
...@@ -125,6 +125,11 @@ class CORE_EXPORT SecurityContext : public GarbageCollectedMixin { ...@@ -125,6 +125,11 @@ class CORE_EXPORT SecurityContext : public GarbageCollectedMixin {
return insecure_request_policy_; return insecure_request_policy_;
} }
void SetMixedAutoupgradeOptOut(bool opt_out) {
mixed_autoupgrade_opt_out_ = opt_out;
}
bool GetMixedAutoUpgradeOptOut() { return mixed_autoupgrade_opt_out_; }
FeaturePolicy* GetFeaturePolicy() const { return feature_policy_.get(); } FeaturePolicy* GetFeaturePolicy() const { return feature_policy_.get(); }
FeaturePolicy* GetReportOnlyFeaturePolicy() const { FeaturePolicy* GetReportOnlyFeaturePolicy() const {
return report_only_feature_policy_.get(); return report_only_feature_policy_.get();
...@@ -176,6 +181,7 @@ class CORE_EXPORT SecurityContext : public GarbageCollectedMixin { ...@@ -176,6 +181,7 @@ class CORE_EXPORT SecurityContext : public GarbageCollectedMixin {
mojom::IPAddressSpace address_space_; mojom::IPAddressSpace address_space_;
WebInsecureRequestPolicy insecure_request_policy_; WebInsecureRequestPolicy insecure_request_policy_;
bool mixed_autoupgrade_opt_out_;
InsecureNavigationsSet insecure_navigations_to_upgrade_; InsecureNavigationsSet insecure_navigations_to_upgrade_;
bool require_safe_types_; bool require_safe_types_;
DISALLOW_COPY_AND_ASSIGN(SecurityContext); DISALLOW_COPY_AND_ASSIGN(SecurityContext);
......
...@@ -653,6 +653,12 @@ void DocumentLoader::ResponseReceived( ...@@ -653,6 +653,12 @@ void DocumentLoader::ResponseReceived(
content_security_policy_ = ContentSecurityPolicy::Create(); content_security_policy_ = ContentSecurityPolicy::Create();
content_security_policy_->SetOverrideURLForSelf(response.Url()); content_security_policy_->SetOverrideURLForSelf(response.Url());
AtomicString mixed_content_header = response.HttpHeaderField("mixed-content");
if (EqualIgnoringASCIICase(mixed_content_header, "noupgrade")) {
frame_->GetDocument()->SetMixedAutoupgradeOptOut(true);
}
if (!frame_->GetSettings()->BypassCSP()) { if (!frame_->GetSettings()->BypassCSP()) {
content_security_policy_->DidReceiveHeaders( content_security_policy_->DidReceiveHeaders(
ContentSecurityPolicyResponseHeaders(response)); ContentSecurityPolicyResponseHeaders(response));
......
...@@ -195,4 +195,33 @@ TEST_F(DocumentLoaderTest, isCommittedButEmpty) { ...@@ -195,4 +195,33 @@ TEST_F(DocumentLoaderTest, isCommittedButEmpty) {
->IsCommittedButEmpty()); ->IsCommittedButEmpty());
} }
TEST_F(DocumentLoaderTest, MixedContentOptOutSetIfHeaderReceived) {
WebURL url =
url_test_helpers::ToKURL("https://examplenoupgrade.com/foo.html");
WebURLResponse response(url);
response.SetHTTPStatusCode(200);
response.SetHTTPHeaderField("mixed-content", "noupgrade");
url_test_helpers::RegisterMockedURLLoadWithCustomResponse(
url, test::CoreTestDataPath("foo.html"), response);
WebViewImpl* web_view_impl = web_view_helper_.InitializeAndLoad(
"https://examplenoupgrade.com/foo.html");
EXPECT_TRUE(ToLocalFrame(web_view_impl->GetPage()->MainFrame())
->Loader()
.GetDocumentLoader()
->GetFrame()
->GetDocument()
->GetMixedAutoUpgradeOptOut());
}
TEST_F(DocumentLoaderTest, MixedContentOptOutNotSetIfNoHeaderReceived) {
WebViewImpl* web_view_impl =
web_view_helper_.InitializeAndLoad("https://example.com/foo.html");
EXPECT_FALSE(ToLocalFrame(web_view_impl->GetPage()->MainFrame())
->Loader()
.GetDocumentLoader()
->GetFrame()
->GetDocument()
->GetMixedAutoUpgradeOptOut());
}
} // namespace blink } // namespace blink
...@@ -1695,6 +1695,7 @@ void FrameLoader::UpgradeInsecureRequest(ResourceRequest& resource_request, ...@@ -1695,6 +1695,7 @@ void FrameLoader::UpgradeInsecureRequest(ResourceRequest& resource_request,
// correctly. // correctly.
if (context != mojom::RequestContextType::UNSPECIFIED && if (context != mojom::RequestContextType::UNSPECIFIED &&
resource_request.Url().ProtocolIs("http") && resource_request.Url().ProtocolIs("http") &&
!origin_context->GetSecurityContext().GetMixedAutoUpgradeOptOut() &&
MixedContentChecker::ShouldAutoupgrade( MixedContentChecker::ShouldAutoupgrade(
origin_context->Url(), origin_context->Url(),
WebMixedContent::ContextTypeFromRequestContext(context, false))) { WebMixedContent::ContextTypeFromRequestContext(context, false))) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment