Bug 140621

Summary:

Frames should be treated as active mixed content

Product:

WebKit

Reporter:

Michael Catanzaro <mcatanzaro>

Component:

WebCore Misc.

Assignee:

Michael Catanzaro <mcatanzaro>

Status:

RESOLVED FIXED

Severity:

Enhancement

CC:

ap, beidson, cgarcia, commit-queue, japhet, mcatanzaro, zan

Priority:

Version:

528+ (Nightly build)

Hardware:

OS:

Linux

Bug Depends on:

Bug Blocks:

140625, 140940

Attachments:

Description	Flags
Patch	none
Patch	none

Michael Catanzaro

Reported 2015-01-19 10:11:52 PST

Frames should be treated as active mixed content. When the top frame (other browsers check the parent frame) is loaded via HTTPS and a subframe is loaded via HTTP, a mixed content callback should be triggered to allow browsers to warn the user or block the content. It's true that the insecure frame cannot modify the contents of the secure frame, but it should not be possible for a substantial portion of the page to be loaded with no security despite the presence of a browser security indicator. Chrome, Firefox, and Internet Explorer all block mixed content frames by default [1]. [1] https://community.qualys.com/blogs/securitylabs/2014/03/19/https-mixed-content-still-the-easiest-way-to-break-ssl

Attachments
Patch (7.93 KB, patch) 2015-01-19 10:21 PST, Michael Catanzaro	no flags	Details Formatted Diff Diff
Patch (7.90 KB, patch) 2015-02-01 10:47 PST, Michael Catanzaro	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Michael Catanzaro

Comment 1 2015-01-19 10:21:28 PST

Created attachment 244905 [details] Patch

Michael Catanzaro

Comment 2 2015-02-01 10:47:54 PST

Created attachment 245835 [details] Patch

Michael Catanzaro

Comment 3 2015-03-06 14:38:37 PST

This is fixed by r181134. I'm not going to file a bug for the minor behavioral difference because our way is easier :)

Note You need to log in before you can comment on or make changes to this bug.