mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2024-09-11 05:25:32 +03:00
LibWeb: Upgrade mixed requests to potentially trustworthy URLs
(if appropriate)
This commit is contained in:
parent
8f0d035145
commit
2159377296
Notes:
sideshowbarker
2024-07-17 02:55:44 +09:00
Author: https://github.com/jamierocks Commit: https://github.com/LadybirdBrowser/ladybird/commit/2159377296 Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/22
@ -237,7 +237,9 @@ WebIDL::ExceptionOr<JS::GCPtr<PendingResponse>> main_fetch(JS::Realm& realm, Inf
|
||||
|
||||
// FIXME: 4. Run report Content Security Policy violations for request.
|
||||
// FIXME: 5. Upgrade request to a potentially trustworthy URL, if appropriate.
|
||||
// FIXME: 6. Upgrade a mixed content request to a potentially trustworthy URL, if appropriate.
|
||||
|
||||
// 6. Upgrade a mixed content request to a potentially trustworthy URL, if appropriate.
|
||||
MixedContent::upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(request);
|
||||
|
||||
// 7. If should request be blocked due to a bad port, should fetching request be blocked as mixed content, or
|
||||
// should request be blocked by Content Security Policy returns blocked, then set response to a network error.
|
||||
|
@ -10,6 +10,36 @@
|
||||
|
||||
namespace Web::MixedContent {
|
||||
|
||||
// https://w3c.github.io/webappsec-mixed-content/#upgrade-algorithm
|
||||
void upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(Fetch::Infrastructure::Request& request)
|
||||
{
|
||||
// 1. If one or more of the following conditions is met, return without modifying request:
|
||||
if (
|
||||
// 1. request’s URL is a potentially trustworthy URL.
|
||||
SecureContexts::is_url_potentially_trustworthy(request.url()) == SecureContexts::Trustworthiness::PotentiallyTrustworthy
|
||||
|
||||
// 2. request’s URL’s host is an IP address.
|
||||
|| request.url().host().has<URL::IPv4Address>() || request.url().host().has<URL::IPv6Address>()
|
||||
|
||||
// 3. § 4.3 Does settings prohibit mixed security contexts? returns "Does Not Restrict Mixed Security Contents" when applied to request’s client.
|
||||
|| does_settings_prohibit_mixed_security_contexts(request.client()) == ProhibitsMixedSecurityContexts::DoesNotRestrictMixedSecurityContexts
|
||||
|
||||
// 4. request’s destination is not "image", "audio", or "video".
|
||||
|| (request.destination() != Fetch::Infrastructure::Request::Destination::Image
|
||||
&& request.destination() != Fetch::Infrastructure::Request::Destination::Audio
|
||||
&& request.destination() != Fetch::Infrastructure::Request::Destination::Video)
|
||||
|
||||
// 5. request’s destination is "image" and request’s initiator is "imageset".
|
||||
|| (request.destination() == Fetch::Infrastructure::Request::Destination::Image
|
||||
&& request.initiator() == Fetch::Infrastructure::Request::Initiator::ImageSet)) {
|
||||
return;
|
||||
}
|
||||
|
||||
// 2. If request’s URL’s scheme is http, set request’s URL’s scheme to https, and return.
|
||||
if (request.url().scheme() == "http")
|
||||
request.url().set_scheme("https"_string);
|
||||
}
|
||||
|
||||
// https://w3c.github.io/webappsec-mixed-content/#categorize-settings-object
|
||||
ProhibitsMixedSecurityContexts does_settings_prohibit_mixed_security_contexts(JS::GCPtr<HTML::EnvironmentSettingsObject> settings)
|
||||
{
|
||||
|
@ -12,6 +12,8 @@
|
||||
|
||||
namespace Web::MixedContent {
|
||||
|
||||
void upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(Fetch::Infrastructure::Request&);
|
||||
|
||||
enum class ProhibitsMixedSecurityContexts {
|
||||
ProhibitsMixedSecurityContexts,
|
||||
DoesNotRestrictMixedSecurityContexts,
|
||||
|
Loading…
Reference in New Issue
Block a user