ChangeLog

2020-12-11  Rob Buis  <rbuis@igalia.com>

        Make MixedContentChecker stateless

        https://bugs.webkit.org/show_bug.cgi?id=219771

        Reviewed by NOBODY (OOPS!).

        Make MixedContentChecker stateless, it only needs the frame

        in a few cased which we can just pass as a parameter. Making

        MixedContentChecker stateless means that FrameLoader does

        not have to know it.

        * Modules/websockets/WebSocket.cpp:

        (WebCore::WebSocket::connect):

        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:

        (WebCore::WorkerThreadableWebSocketChannel::Bridge::connect):

        * html/HTMLFormElement.cpp:

        (WebCore::HTMLFormElement::parseAttribute):

        * html/parser/XSSAuditor.cpp:

        * loader/DocumentLoader.cpp:

        (WebCore::DocumentLoader::willSendRequest):

        * loader/DocumentThreadableLoader.cpp:

        (WebCore::DocumentThreadableLoader::loadRequest):

        * loader/FrameLoader.cpp:

        (WebCore::FrameLoader::FrameLoader):

        * loader/FrameLoader.h:

        * loader/MixedContentChecker.cpp:

        (WebCore::logWarning):

        (WebCore::MixedContentChecker::canDisplayInsecureContent):

        (WebCore::MixedContentChecker::canRunInsecureContent):

        (WebCore::MixedContentChecker::checkFormForMixedContent):

        (WebCore::MixedContentChecker::checkForMixedContentInFrameTree):

        (WebCore::MixedContentChecker::MixedContentChecker): Deleted.

        (WebCore::MixedContentChecker::client const): Deleted.

        (WebCore::MixedContentChecker::canDisplayInsecureContent const): Deleted.

        (WebCore::MixedContentChecker::canRunInsecureContent const): Deleted.

        (WebCore::MixedContentChecker::checkFormForMixedContent const): Deleted.

        (WebCore::MixedContentChecker::logWarning const): Deleted.

        * loader/MixedContentChecker.h:

        * loader/SubframeLoader.cpp:

        (WebCore::FrameLoader::SubframeLoader::pluginIsLoadable):

        * loader/cache/CachedResourceLoader.cpp:

        (WebCore::CachedResourceLoader::checkInsecureContent const):

2020-12-10  Alex Christensen  <achristensen@webkit.org>

        Accept click measurement data from hosting application

Source/WebCore/Modules/websockets/WebSocket.cpp

#include "FrameLoaderClient.h"

#include "Logging.h"

#include "MessageEvent.h"

48#include "MixedContentChecker.h"

#include "ResourceLoadObserver.h"

#include "ScriptController.h"

#include "ScriptExecutionContext.h"

@@ExceptionOr<void> WebSocket::connect(const String& url, const Vector<String>& pr

        Document& document = downcast<Document>(context);

        RefPtr<Frame> frame = document.frame();

        // FIXME: make the mixed content check equivalent to the non-document mixed content check currently in WorkerThreadableWebSocketChannel::Bridge::connect()

313 if (!frame || !~~frame->loader().m~~ixedContentChecker~~().~~canRunInsecureContent(document.securityOrigin(), m_url)) {

314 if (!frame || !MixedContentChecker::canRunInsecureContent(*frame, document.securityOrigin(), m_url)) {

            failAsynchronously();

            return { };

        }

Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp

#include "Blob.h"

#include "Document.h"

#include "Frame.h"

37 #include "~~Fram~~eL~~oad~~er.h"

37#include "MixedContentChecker.h"

#include "ScriptExecutionContext.h"

#include "SocketProvider.h"

#include "ThreadableWebSocketChannelClientWrapper.h"

@@void WorkerThreadableWebSocketChannel::Bridge::connect(const URL& url, const Str

        
        // FIXME: make this mixed content check equivalent to the document mixed content check currently in WebSocket::connect()

        if (document.frame()) {

414 Optional<String> errorString = ~~document.frame()->loader().m~~ixedContentChecker~~().~~checkForMixedContentInFrameTree(url);

414 Optional<String> errorString = MixedContentChecker::checkForMixedContentInFrameTree(*document.frame(), url);

            if (errorString) {

                peer->fail(errorString.value());

                return;

Source/WebCore/html/HTMLFormElement.cpp

#include "HTMLObjectElement.h"

#include "HTMLParserIdioms.h"

#include "HTMLTableElement.h"

47#include "MixedContentChecker.h"

#include "NodeRareData.h"

#include "Page.h"

#include "RadioNodeList.h"

@@void HTMLFormElement::parseAttribute(const QualifiedName& name, const AtomString

        if (!m_attributes.action().isEmpty()) {

            if (RefPtr<Frame> f = document().frame()) {

                Frame& topFrame = f->tree().top();

450 ~~topFrame.loader().m~~ixedContentChecker~~().~~checkFormForMixedContent(topFrame.document()->securityOrigin(), document().completeURL(m_attributes.action()));

451 MixedContentChecker::checkFormForMixedContent(topFrame, topFrame.document()->securityOrigin(), document().completeURL(m_attributes.action()));

            }

        }

    } else if (name == targetAttr)

Source/WebCore/html/parser/XSSAuditor.cpp

#include "HTMLNames.h"

#include "HTMLParamElement.h"

#include "HTMLParserIdioms.h"

41#include "MixedContentChecker.h"

#include "SVGNames.h"

#include "Settings.h"

#include "TextResourceDecoder.h"

Source/WebCore/loader/DocumentLoader.cpp

#include "LoaderStrategy.h"

#include "Logging.h"

#include "MemoryCache.h"

70#include "MixedContentChecker.h"

#include "NavigationScheduler.h"

#include "NetworkLoadMetrics.h"

#include "NetworkStorageSession.h"

@@void DocumentLoader::willSendRequest(ResourceRequest&& newRequest, const Resourc

        newRequest.setCachePolicy(ResourceRequestCachePolicy::ReloadIgnoringCacheData);

    if (&topFrame != m_frame) {

647 if (!~~m_frame->loader().m~~ixedContentChecker~~().~~canDisplayInsecureContent(m_frame->document()->securityOrigin(), MixedContentChecker::ContentType::Active, newRequest.url(), MixedContentChecker::AlwaysDisplayInNonStrictMode::Yes)) {

648 if (!MixedContentChecker::canDisplayInsecureContent(*m_frame, m_frame->document()->securityOrigin(), MixedContentChecker::ContentType::Active, newRequest.url(), MixedContentChecker::AlwaysDisplayInNonStrictMode::Yes)) {

            cancelMainResourceLoad(frameLoader()->cancelledError(newRequest));

            return completionHandler(WTFMove(newRequest));

        }

651 if (!~~frameLoader()->m~~ixedContentChecker~~().~~canDisplayInsecureContent(topFrame.document()->securityOrigin(), MixedContentChecker::ContentType::Active, newRequest.url())) {

652 if (!MixedContentChecker::canDisplayInsecureContent(*m_frame, topFrame.document()->securityOrigin(), MixedContentChecker::ContentType::Active, newRequest.url())) {

            cancelMainResourceLoad(frameLoader()->cancelledError(newRequest));

            return completionHandler(WTFMove(newRequest));

        }

Source/WebCore/loader/DocumentThreadableLoader.cpp

#include "DOMWindow.h"

#include "Document.h"

#include "Frame.h"

44 #include "FrameLoader.h"

#include "InspectorInstrumentation.h"

#include "LegacySchemeRegistry.h"

#include "LoadTiming.h"

#include "LoaderStrategy.h"

48#include "MixedContentChecker.h"

#include "Performance.h"

#include "PlatformStrategies.h"

#include "ProgressTracker.h"

@@void DocumentThreadableLoader::loadRequest(ResourceRequest&& request, SecurityCh

    ResourceResponse response;

    unsigned long identifier = std::numeric_limits<unsigned long>::max();

    if (m_document.frame()) {

594 auto& frameLoader = m_document.frame()->loader();

595 if (!frameLoader.mixedContentChecker().canRunInsecureContent(m_document.securityOrigin(), requestURL))

594 if (!MixedContentChecker::canRunInsecureContent(*m_document.frame(), m_document.securityOrigin(), requestURL))

596595 return;

596 auto& frameLoader = m_document.frame()->loader();

        identifier = frameLoader.loadResourceSynchronously(request, m_options.clientCredentialPolicy, m_options, *m_originalHeaders, error, response, data);

    }

Source/WebCore/loader/FrameLoader.cpp

@@FrameLoader::FrameLoader(Frame& frame, UniqueRef<FrameLoaderClient>&& client)

    , m_history(makeUnique<HistoryController>(frame))

    , m_notifier(frame)

    , m_subframeLoader(makeUnique<SubframeLoader>(frame))

299 , m_mixedContentChecker(frame)

    , m_state(FrameStateProvisional)

    , m_loadType(FrameLoadType::Standard)

    , m_quickRedirectComing(false)

Source/WebCore/loader/FrameLoader.h

#include "FrameLoaderStateMachine.h"

#include "FrameLoaderTypes.h"

#include "LayoutMilestone.h"

39 #include "MixedContentChecker.h"

#include "PageIdentifier.h"

#include "PrivateClickMeasurement.h"

#include "ReferrerPolicy.h"

@@public:

    class SubframeLoader;

    SubframeLoader& subframeLoader() { return *m_subframeLoader; }

    const SubframeLoader& subframeLoader() const { return *m_subframeLoader; }

122 MixedContentChecker& mixedContentChecker() const { return m_mixedContentChecker; }

    void setupForReplace();

@@private:

    mutable ResourceLoadNotifier m_notifier;

    const std::unique_ptr<SubframeLoader> m_subframeLoader;

    mutable FrameLoaderStateMachine m_stateMachine;

442 mutable MixedContentChecker m_mixedContentChecker;

    class FrameProgressTracker;

    std::unique_ptr<FrameProgressTracker> m_progressTracker;

Source/WebCore/loader/MixedContentChecker.cpp

namespace WebCore {

MixedContentChecker::MixedContentChecker(Frame& frame)

    : m_frame(frame)

{

}

FrameLoaderClient& MixedContentChecker::client() const

{

    return m_frame.loader().client();

}

// static

bool MixedContentChecker::isMixedContent(SecurityOrigin& securityOrigin, const URL& url)

{

@@bool MixedContentChecker::isMixedContent(SecurityOrigin& securityOrigin, const U

    return !SecurityOrigin::isSecure(url);

}

65 bool MixedContentChecker::canDisplayInsecureContent(SecurityOrigin& securityOrigin, ContentType type, const URL& url, AlwaysDisplayInNonStrictMode alwaysDisplayInNonStrictMode) const

static void logWarning(const Frame& frame, bool allowed, const String& action, const URL& target)

{

    const char* errorString = allowed ? " was allowed to " : " was not allowed to ";

    String message = makeString((allowed ? String() : "[blocked] "), "The page at ", frame.document()->url().stringCenterEllipsizedToLength(), errorString, action, " insecure content from ", target.stringCenterEllipsizedToLength(), ".\n");

    frame.document()->addConsoleMessage(MessageSource::Security, MessageLevel::Warning, message);

}

bool MixedContentChecker::canDisplayInsecureContent(Frame& frame, SecurityOrigin& securityOrigin, ContentType type, const URL& url, AlwaysDisplayInNonStrictMode alwaysDisplayInNonStrictMode)

{

    if (!isMixedContent(securityOrigin, url))

        return true;

70 if (!m_frame.document()->contentSecurityPolicy()->allowRunningOrDisplayingInsecureContent(url))

67 if (!frame.document()->contentSecurityPolicy()->allowRunningOrDisplayingInsecureContent(url))

7168 return false;

7269

73 bool isStrictMode = m_frame.document()->isStrictMixedContentMode();

70 bool isStrictMode = frame.document()->isStrictMixedContentMode();

    if (!isStrictMode && alwaysDisplayInNonStrictMode == AlwaysDisplayInNonStrictMode::Yes)

        return true;

77 bool allowed = !isStrictMode && (m_frame.settings().allowDisplayOfInsecureContent() || type == ContentType::ActiveCanWarn) && !m_frame.document()->geolocationAccessed();

78 logWarning(allowed, "display", url);

74 bool allowed = !isStrictMode && (frame.settings().allowDisplayOfInsecureContent() || type == ContentType::ActiveCanWarn) && !frame.document()->geolocationAccessed();

75 logWarning(frame, allowed, "display", url);

7976

8077 if (allowed) {

81 m_frame.document()->setFoundMixedContent(SecurityContext::MixedContentType::Inactive);

82 client().didDisplayInsecureContent();

78 frame.document()->setFoundMixedContent(SecurityContext::MixedContentType::Inactive);

79 frame.loader().client().didDisplayInsecureContent();

    }

    return allowed;

}

88 bool MixedContentChecker::canRunInsecureContent(SecurityOrigin& securityOrigin, const URL& url) ~~const~~

85bool MixedContentChecker::canRunInsecureContent(Frame& frame, SecurityOrigin& securityOrigin, const URL& url)

{

    if (!isMixedContent(securityOrigin, url))

        return true;

93 if (!m_frame.document()->contentSecurityPolicy()->allowRunningOrDisplayingInsecureContent(url))

90 if (!frame.document()->contentSecurityPolicy()->allowRunningOrDisplayingInsecureContent(url))

9491 return false;

9592

96 bool allowed = !m_frame.document()->isStrictMixedContentMode() && m_frame.settings().allowRunningOfInsecureContent() && !m_frame.document()->geolocationAccessed() && !m_frame.document()->secureCookiesAccessed();

97 logWarning(allowed, "run", url);

93 bool allowed = !frame.document()->isStrictMixedContentMode() && frame.settings().allowRunningOfInsecureContent() && !frame.document()->geolocationAccessed() && !frame.document()->secureCookiesAccessed();

94 logWarning(frame, allowed, "run", url);

9895

9996 if (allowed) {

100 m_frame.document()->setFoundMixedContent(SecurityContext::MixedContentType::Active);

101 client().didRunInsecureContent(securityOrigin, url);

97 frame.document()->setFoundMixedContent(SecurityContext::MixedContentType::Active);

98 frame.loader().client().didRunInsecureContent(securityOrigin, url);

    }

    return allowed;

}

107 void MixedContentChecker::checkFormForMixedContent(SecurityOrigin& securityOrigin, const URL& url) ~~const~~

104void MixedContentChecker::checkFormForMixedContent(Frame& frame, SecurityOrigin& securityOrigin, const URL& url)

{

    // Unconditionally allow javascript: URLs as form actions as some pages do this and it does not introduce

    // a mixed content issue.

@@void MixedContentChecker::checkFormForMixedContent(SecurityOrigin& securityOrigi

    if (!isMixedContent(securityOrigin, url))

        return;

117 String message = makeString("The page at ", m_frame.document()->url().stringCenterEllipsizedToLength(), " contains a form which targets an insecure URL ", url.stringCenterEllipsizedToLength(), ".\n");

118 m_frame.document()->addConsoleMessage(MessageSource::Security, MessageLevel::Warning, message);

114 String message = makeString("The page at ", frame.document()->url().stringCenterEllipsizedToLength(), " contains a form which targets an insecure URL ", url.stringCenterEllipsizedToLength(), ".\n");

115 frame.document()->addConsoleMessage(MessageSource::Security, MessageLevel::Warning, message);

119116

120 client().didDisplayInsecureContent();

117 frame.loader().client().didDisplayInsecureContent();

121118}

122119

123 Optional<String> MixedContentChecker::checkForMixedContentInFrameTree(const URL& url)

120Optional<String> MixedContentChecker::checkForMixedContentInFrameTree(const Frame& frame, const URL& url)

124121{

125 auto* document = m_frame.document();

122 auto* document = frame.document();

    while (document) {

        RELEASE_ASSERT_WITH_MESSAGE(document->frame(), "An unparented document tried to connect to a websocket with url: %s", url.string().utf8().data());

@@Optional<String> MixedContentChecker::checkForMixedContentInFrameTree(const URL&

    return WTF::nullopt;

}

void MixedContentChecker::logWarning(bool allowed, const String& action, const URL& target) const

{

    const char* errorString = allowed ? " was allowed to " : " was not allowed to ";

    String message = makeString((allowed ? String() : "[blocked] "), "The page at ", m_frame.document()->url().stringCenterEllipsizedToLength(), errorString, action, " insecure content from ", target.stringCenterEllipsizedToLength(), ".\n");

    m_frame.document()->addConsoleMessage(MessageSource::Security, MessageLevel::Warning, message);

}

152142} // namespace WebCore

Source/WebCore/loader/MixedContentChecker.h

@@public:

        ActiveCanWarn,

    };

50 MixedContentChecker(Frame&);

51

    enum class AlwaysDisplayInNonStrictMode {

        No,

        Yes,

    };

    bool canDisplayInsecureContent(SecurityOrigin&, ContentType, const URL&, AlwaysDisplayInNonStrictMode = AlwaysDisplayInNonStrictMode::No) const;

    bool canRunInsecureContent(SecurityOrigin&, const URL&) const;

    void checkFormForMixedContent(SecurityOrigin&, const URL&) const;

    static bool isMixedContent(SecurityOrigin&, const URL&);

    Optional<String> checkForMixedContentInFrameTree(const URL&);

private:

6455 // FIXME: This should probably have a separate client from FrameLoader.

    FrameLoaderClient& client() const;

    void logWarning(bool allowed, const String& action, const URL&) const;

    Frame& m_frame;

    static bool canDisplayInsecureContent(Frame&, SecurityOrigin&, ContentType, const URL&, AlwaysDisplayInNonStrictMode = AlwaysDisplayInNonStrictMode::No);

    static bool canRunInsecureContent(Frame&, SecurityOrigin&, const URL&);

    static void checkFormForMixedContent(Frame&, SecurityOrigin&, const URL&);

    static bool isMixedContent(SecurityOrigin&, const URL&);

    static Optional<String> checkForMixedContentInFrameTree(const Frame&, const URL&);

};

} // namespace WebCore

Source/WebCore/loader/SubframeLoader.cpp

#include "DiagnosticLoggingKeys.h"

#include "DocumentLoader.h"

#include "Frame.h"

41 #include "FrameLoader.h"

#include "FrameLoaderClient.h"

#include "HTMLFrameElement.h"

#include "HTMLIFrameElement.h"

#include "HTMLNames.h"

#include "HTMLObjectElement.h"

#include "MIMETypeRegistry.h"

47#include "MixedContentChecker.h"

#include "NavigationScheduler.h"

#include "Page.h"

#include "PluginData.h"

@@bool FrameLoader::SubframeLoader::pluginIsLoadable(const URL& url, const String&

            return false;

        }

143 if (!~~m_frame.loader().m~~ixedContentChecker~~().~~canRunInsecureContent(document->securityOrigin(), url))

143 if (!MixedContentChecker::canRunInsecureContent(m_frame, document->securityOrigin(), url))

            return false;

    }

Source/WebCore/loader/cache/CachedResourceLoader.cpp

#include "LocalizedStrings.h"

#include "Logging.h"

#include "MemoryCache.h"

65#include "MixedContentChecker.h"

#include "Page.h"

#include "PingLoader.h"

#include "PlatformStrategies.h"

@@bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const

        // These resource can inject script into the current document (Script,

        // XSL) or exfiltrate the content of the current document (CSS).

        if (Frame* frame = this->frame()) {

422 if (!~~frame->loader().m~~ixedContentChecker~~().~~canRunInsecureContent(m_document->securityOrigin(), url))

423 if (!MixedContentChecker::canRunInsecureContent(*frame, m_document->securityOrigin(), url))

423424 return false;

424425 Frame& top = frame->tree().top();

425 if (&top != frame && !~~top.loader().m~~ixedContentChecker~~().~~canRunInsecureContent(top.document()->securityOrigin(), url))

426 if (&top != frame && !MixedContentChecker::canRunInsecureContent(top, top.document()->securityOrigin(), url))

                return false;

        }

        break;

@@bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const

    case CachedResource::Type::FontResource: {

        // These resources can corrupt only the frame's pixels.

        if (Frame* frame = this->frame()) {

440 if (!~~frame->loader().m~~ixedContentChecker~~().~~canDisplayInsecureContent(m_document->securityOrigin(), contentTypeFromResourceType(type), url, MixedContentChecker::AlwaysDisplayInNonStrictMode::Yes))

441 if (!MixedContentChecker::canDisplayInsecureContent(*frame, m_document->securityOrigin(), contentTypeFromResourceType(type), url, MixedContentChecker::AlwaysDisplayInNonStrictMode::Yes))

441442 return false;

442443 Frame& topFrame = frame->tree().top();

443 if (!~~topFrame.loader().m~~ixedContentChecker~~().~~canDisplayInsecureContent(topFrame.document()->securityOrigin(), contentTypeFromResourceType(type), url))

444 if (!MixedContentChecker::canDisplayInsecureContent(topFrame, topFrame.document()->securityOrigin(), contentTypeFromResourceType(type), url))

                return false;

        }

        break;