Skip to content

GitLab

T
tangled
Commit 95bd3115 authored by mkwst@chromium.org's avatar mkwst@chromium.org
Browse files
Options

Block mixed content fonts. 

This matches Firefox's behavior.

Review URL: https://codereview.chromium.org/302283002

git-svn-id: svn://svn.chromium.org/blink/trunk@175498 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent e7c93e0a
Hide whitespace changes
Inline Side-by-side
Showing with 57 additions and 6 deletions
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-font-in-main-frame-expected.txt 0 → 100644
View file @ 95bd3115
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-font.html' was loaded over HTTPS, but ran insecure content from 'http://127.0.0.1:8080/resources/Ahem.ttf': this content should also be loaded over HTTPS.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-font.html' was loaded over HTTPS, but ran insecure content from 'http://127.0.0.1:8080/resources/Ahem.ttf': this content should also be loaded over HTTPS.
CONSOLE WARNING: Blink is considering rejecting non spec-compliant cross-origin web font requests: http://127.0.0.1:8080/resources/Ahem.ttf. Please use Access-Control-Allow-Origin to make these requests spec-compliant.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-font.html' was loaded over HTTPS, but ran insecure content from 'http://127.0.0.1:8080/resources/Ahem.ttf': this content should also be loaded over HTTPS.
This test opens a window that loads an insecure font. We should trigger a mixed content callback because the main frame in the window is HTTPS but is displaying insecure content.
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-font-in-main-frame.html 0 → 100644
View file @ 95bd3115
<html>
<body>
<script>
if (window.testRunner) {
testRunner.waitUntilDone();
testRunner.dumpAsText();
testRunner.setCanOpenWindows();
testRunner.setCloseRemainingWindowsWhenComplete(true);
}
window.addEventListener("message", function (e) {
if (window.testRunner)
testRunner.notifyDone();
}, false);
</script>
<p>This test opens a window that loads an insecure font. We should trigger a
mixed content callback because the main frame in the window is HTTPS but is
displaying insecure content.</p>
<script>
window.open("https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-font.html");
</script>
</body>
</html>
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-sync-post-xhr-allowed-expected.txt
View file @ 95bd3115
ALERT: Executing script in the child window.
ALERT: XHR POST opened.
CONSOLE MESSAGE: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-sync-xhr-post.html' was loaded over HTTPS, but ran insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-lists.php?origin=*&headers=Content-Type': this content should also be loaded over HTTPS.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-sync-xhr-post.html' was loaded over HTTPS, but displayed insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-lists.php?origin=*&headers=Content-Type': this content should also be loaded over HTTPS.
ALERT: XHR POST sent.
This test opens a HTTPS window that loads insecure data via XHR. We should trigger a mixed content callback because the main frame in the window is HTTPS but now has insecure data.
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-sync-post-xhr-blocked-expected.txt
View file @ 95bd3115
ALERT: Executing script in the child window.
ALERT: XHR POST opened.
CONSOLE MESSAGE: [blocked] The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-sync-xhr-post.html' was loaded over HTTPS, but ran insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-lists.php?origin=*&headers=Content-Type': this content should also be loaded over HTTPS.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/security/mixedContent/resources/frame-with-insecure-sync-xhr-post.html' was loaded over HTTPS, but displayed insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-lists.php?origin=*&headers=Content-Type': this content should also be loaded over HTTPS.
ALERT: exception! NetworkError: A network error occurred.
ALERT: XHR POST sent.
This test opens a HTTPS window that loads insecure data via XHR. We should trigger a mixed content callback and block the load.
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-xhr-in-main-frame-expected.txt
View file @ 95bd3115
CONSOLE MESSAGE: The page at 'https://127.0.0.1:8443/xmlhttprequest/access-control-response-with-body.html' was loaded over HTTPS, but ran insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-with-body.php': this content should also be loaded over HTTPS.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/xmlhttprequest/access-control-response-with-body.html' was loaded over HTTPS, but displayed insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-with-body.php': this content should also be loaded over HTTPS.
CONSOLE MESSAGE: The page at 'https://127.0.0.1:8443/xmlhttprequest/access-control-response-with-body.html' was loaded over HTTPS, but ran insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-with-body.php': this content should also be loaded over HTTPS.
CONSOLE WARNING: The page at 'https://127.0.0.1:8443/xmlhttprequest/access-control-response-with-body.html' was loaded over HTTPS, but displayed insecure content from 'http://localhost:8000/xmlhttprequest/resources/access-control-allow-with-body.php': this content should also be loaded over HTTPS.
This test opens a HTTPS window that loads insecure data via XHR. We should trigger a mixed content callback because the main frame in the window is HTTPS but now has insecure data.
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/resources/frame-with-insecure-font.html 0 → 100644
View file @ 95bd3115
<style>
@font-face {
font-family: "AhemTest";
src: url(http://127.0.0.1:8080/resources/Ahem.ttf);
}
p { font-family: AhemTest; }
</style>
<p>Yay!</p>
<script>
window.onload = function() {
if (window.opener)
window.opener.postMessage('done', '*');
};
</script>
third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
View file @ 95bd3115
......@@ -422,10 +422,15 @@ bool ResourceFetcher::checkInsecureContent(Resource::Type type, const KURL& url,
treatment = TreatAsActiveContent;
break;
case Resource::Font:
// These resources are passive, but mixed usage is low enough that we
// can block them in a mixed context.
treatment = TreatAsActiveContent;
break;
case Resource::TextTrack:
case Resource::Raw:
case Resource::Image:
case Resource::Font:
case Resource::Media:
// These resources can corrupt only the frame's pixels.
treatment = TreatAsPassiveContent;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment