mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-09 09:39:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibWeb: Upgrade mixed requests to potentially trustworthy URLs

Browse source 
(if appropriate)
This commit is contained in:
Jamie Mansfield 2024-05-29 19:27:27 +01:00 • committed by Andreas Kling
commit 2159377296
Notes: sideshowbarker 2024-07-17 02:55:44 +09:00
3 changed files with 35 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
View file

@ -237,7 +237,9 @@ WebIDL::ExceptionOr<JS::GCPtr<PendingResponse>> main_fetch(JS::Realm& realm, Inf
// FIXME: 4. Run report Content Security Policy violations for request.
// FIXME: 5. Upgrade request to a potentially trustworthy URL, if appropriate.
// FIXME: 6. Upgrade a mixed content request to a potentially trustworthy URL, if appropriate.
// 6. Upgrade a mixed content request to a potentially trustworthy URL, if appropriate.
MixedContent::upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(request);
// 7. If should request be blocked due to a bad port, should fetching request be blocked as mixed content, or
// should request be blocked by Content Security Policy returns blocked, then set response to a network error.

30
Userland/Libraries/LibWeb/MixedContent/AbstractOperations.cpp
View file

@ -10,6 +10,36 @@
namespace Web::MixedContent {
// https://w3c.github.io/webappsec-mixed-content/#upgrade-algorithm
void upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(Fetch::Infrastructure::Request& request)
{
// 1. If one or more of the following conditions is met, return without modifying request:
if (
// 1. request’s URL is a potentially trustworthy URL.
SecureContexts::is_url_potentially_trustworthy(request.url()) == SecureContexts::Trustworthiness::PotentiallyTrustworthy
// 2. request’s URL’s host is an IP address.
|| request.url().host().has<URL::IPv4Address>() || request.url().host().has<URL::IPv6Address>()
// 3. § 4.3 Does settings prohibit mixed security contexts? returns "Does Not Restrict Mixed Security Contents" when applied to request’s client.
|| does_settings_prohibit_mixed_security_contexts(request.client()) == ProhibitsMixedSecurityContexts::DoesNotRestrictMixedSecurityContexts
// 4. request’s destination is not "image", "audio", or "video".
|| (request.destination() != Fetch::Infrastructure::Request::Destination::Image
&& request.destination() != Fetch::Infrastructure::Request::Destination::Audio
&& request.destination() != Fetch::Infrastructure::Request::Destination::Video)
// 5. request’s destination is "image" and request’s initiator is "imageset".
|| (request.destination() == Fetch::Infrastructure::Request::Destination::Image
&& request.initiator() == Fetch::Infrastructure::Request::Initiator::ImageSet)) {
return;
}
// 2. If request’s URL’s scheme is http, set request’s URL’s scheme to https, and return.
if (request.url().scheme() == "http")
request.url().set_scheme("https"_string);
}
// https://w3c.github.io/webappsec-mixed-content/#categorize-settings-object
ProhibitsMixedSecurityContexts does_settings_prohibit_mixed_security_contexts(JS::GCPtr<HTML::EnvironmentSettingsObject> settings)
{

2
Userland/Libraries/LibWeb/MixedContent/AbstractOperations.h
View file

@ -12,6 +12,8 @@
namespace Web::MixedContent {
void upgrade_a_mixed_content_request_to_a_potentially_trustworthy_url_if_appropriate(Fetch::Infrastructure::Request&);
enum class ProhibitsMixedSecurityContexts {
ProhibitsMixedSecurityContexts,
DoesNotRestrictMixedSecurityContexts,