/* * Copyright (C) 2012 Google Inc. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of * its contributors may be used to endorse or promote products derived * from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "third_party/blink/renderer/core/loader/mixed_content_checker.h" #include <optional> #include "base/containers/contains.h" #include "base/feature_list.h" #include "base/metrics/field_trial_params.h" #include "build/build_config.h" #include "build/chromecast_buildflags.h" #include "services/network/public/cpp/features.h" #include "services/network/public/cpp/is_potentially_trustworthy.h" #include "third_party/blink/public/common/features.h" #include "third_party/blink/public/common/security_context/insecure_request_policy.h" #include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-blink.h" #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink.h" #include "third_party/blink/public/mojom/frame/frame.mojom-blink.h" #include "third_party/blink/public/mojom/loader/mixed_content.mojom-blink.h" #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom-blink.h" #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h" #include "third_party/blink/public/platform/web_content_settings_client.h" #include "third_party/blink/public/platform/web_security_origin.h" #include "third_party/blink/public/platform/web_worker_fetch_context.h" #include "third_party/blink/renderer/core/dom/document.h" #include "third_party/blink/renderer/core/frame/frame.h" #include "third_party/blink/renderer/core/frame/local_dom_window.h" #include "third_party/blink/renderer/core/frame/local_frame.h" #include "third_party/blink/renderer/core/frame/local_frame_client.h" #include "third_party/blink/renderer/core/frame/settings.h" #include "third_party/blink/renderer/core/inspector/console_message.h" #include "third_party/blink/renderer/core/inspector/inspector_audits_issue.h" #include "third_party/blink/renderer/core/loader/document_loader.h" #include "third_party/blink/renderer/core/loader/frame_fetch_context.h" #include "third_party/blink/renderer/core/loader/worker_fetch_context.h" #include "third_party/blink/renderer/core/probe/core_probes.h" #include "third_party/blink/renderer/core/workers/worker_global_scope.h" #include "third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h" #include "third_party/blink/renderer/core/workers/worker_settings.h" #include "third_party/blink/renderer/platform/heap/garbage_collected.h" #include "third_party/blink/renderer/platform/instrumentation/use_counter.h" #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher_properties.h" #include "third_party/blink/renderer/platform/loader/mixed_content.h" #include "third_party/blink/renderer/platform/network/network_utils.h" #include "third_party/blink/renderer/platform/runtime_enabled_features.h" #include "third_party/blink/renderer/platform/weborigin/scheme_registry.h" #include "third_party/blink/renderer/platform/weborigin/security_origin.h" #include "third_party/blink/renderer/platform/wtf/text/string_builder.h" namespace blink { namespace { // When a frame is local, use its full URL to represent the main resource. When // the frame is remote, the full URL isn't accessible, so use the origin. This // function is used, for example, to determine the URL to show in console // messages about mixed content. KURL MainResourceUrlForFrame(Frame* frame) { … } const char* RequestContextName(mojom::blink::RequestContextType context) { … } // Currently we have two slightly different versions, because // in frames SecurityContext is the source of CSP/InsecureRequestPolicy, // especially where FetchContext and SecurityContext come from different // frames (e.g. in nested frames), while in // workers we should totally rely on FetchContext's FetchClientSettingsObject // to avoid confusion around off-the-main-thread fetch. // TODO(hiroshige): Consider merging them once FetchClientSettingsObject // becomes the source of CSP/InsecureRequestPolicy also in frames. bool IsWebSocketAllowedInFrame(const BaseFetchContext& fetch_context, const SecurityContext* security_context, Settings* settings, const KURL& url) { … } bool IsWebSocketAllowedInWorker(const WorkerFetchContext& fetch_context, WorkerSettings* settings, const KURL& url) { … } bool IsUrlPotentiallyTrustworthy(const KURL& url) { … } } // namespace static bool IsInsecureUrl(const KURL& url) { … } static void MeasureStricterVersionOfIsMixedContent(Frame& frame, const KURL& url, const LocalFrame* source) { … } bool RequestIsSubframeSubresource(Frame* frame) { … } // static bool MixedContentChecker::IsMixedContent(const SecurityOrigin* security_origin, const KURL& url) { … } // static bool MixedContentChecker::IsMixedContent(const String& origin_protocol, const KURL& url) { … } // static bool MixedContentChecker::IsMixedContent( const FetchClientSettingsObject& settings, const KURL& url) { … } // static Frame* MixedContentChecker::InWhichFrameIsContentMixed(LocalFrame* frame, const KURL& url) { … } // static ConsoleMessage* MixedContentChecker::CreateConsoleMessageAboutFetch( const KURL& main_resource_url, const KURL& url, mojom::blink::RequestContextType request_context, bool allowed, std::unique_ptr<SourceLocation> source_location) { … } // static void MixedContentChecker::Count( Frame* frame, mojom::blink::RequestContextType request_context, const LocalFrame* source) { … } // static bool MixedContentChecker::ShouldBlockFetch( LocalFrame* frame, mojom::blink::RequestContextType request_context, network::mojom::blink::IPAddressSpace target_address_space, const KURL& url_before_redirects, ResourceRequest::RedirectStatus redirect_status, const KURL& url, const String& devtools_id, ReportingDisposition reporting_disposition, mojom::blink::ContentSecurityNotifier& notifier) { … } // static bool MixedContentChecker::ShouldBlockFetchOnWorker( WorkerFetchContext& worker_fetch_context, mojom::blink::RequestContextType request_context, const KURL& url_before_redirects, ResourceRequest::RedirectStatus redirect_status, const KURL& url, ReportingDisposition reporting_disposition, bool is_worklet_global_scope) { … } // static ConsoleMessage* MixedContentChecker::CreateConsoleMessageAboutWebSocket( const KURL& main_resource_url, const KURL& url, bool allowed) { … } // static bool MixedContentChecker::IsWebSocketAllowed( const FrameFetchContext& frame_fetch_context, LocalFrame* frame, const KURL& url) { … } // static bool MixedContentChecker::IsWebSocketAllowed( WorkerFetchContext& worker_fetch_context, const KURL& url) { … } bool MixedContentChecker::IsMixedFormAction( LocalFrame* frame, const KURL& url, ReportingDisposition reporting_disposition) { … } bool MixedContentChecker::ShouldAutoupgrade( const FetchClientSettingsObject* fetch_client_settings_object, mojom::blink::RequestContextType type, WebContentSettingsClient* settings_client, const ResourceRequest& resource_request, ExecutionContext* execution_context_for_logging) { … } void MixedContentChecker::HandleCertificateError( const ResourceResponse& response, mojom::blink::RequestContextType request_context, MixedContent::CheckModeForPlugin check_mode_for_plugin, mojom::blink::ContentSecurityNotifier& notifier) { … } // static void MixedContentChecker::MixedContentFound( LocalFrame* frame, const KURL& main_resource_url, const KURL& mixed_content_url, mojom::blink::RequestContextType request_context, bool was_allowed, const KURL& url_before_redirects, bool had_redirect, std::unique_ptr<SourceLocation> source_location) { … } // static ConsoleMessage* MixedContentChecker::CreateConsoleMessageAboutFetchAutoupgrade( const KURL& main_resource_url, const KURL& mixed_content_url) { … } // static ConsoleMessage* MixedContentChecker::CreateConsoleMessageAboutFetchIPAddressNoAutoupgrade( const KURL& main_resource_url, const KURL& mixed_content_url) { … } mojom::blink::MixedContentContextType MixedContentChecker::ContextTypeForInspector(LocalFrame* frame, const ResourceRequest& request) { … } // static void MixedContentChecker::UpgradeInsecureRequest( ResourceRequest& resource_request, const FetchClientSettingsObject* fetch_client_settings_object, ExecutionContext* execution_context_for_logging, mojom::RequestContextFrameType frame_type, WebContentSettingsClient* settings_client) { … } // static MixedContent::CheckModeForPlugin MixedContentChecker::DecideCheckModeForPlugin( Settings* settings) { … } } // namespace blink
Codebase Browser
chromium