mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-30 12:27:29 +09:00
Remove support and tests for HSTS priming from the tree. Fixes #384
This commit is contained in:
Gaming4JC
Roy Tam
parent
96a0af1be8
commit
d4ac94cf3e
56 changed files with 26 additions and 1812 deletions
|
|
@ -8,8 +8,6 @@
|
|||
#include "nsContentUtils.h"
|
||||
#include "nsCORSListenerProxy.h"
|
||||
#include "nsIStreamListener.h"
|
||||
#include "nsIDocument.h"
|
||||
#include "nsMixedContentBlocker.h"
|
||||
#include "nsCDefaultURIFixup.h"
|
||||
#include "nsIURIFixup.h"
|
||||
|
||||
|
|
@ -507,13 +505,6 @@ DoContentSecurityChecks(nsIChannel* aChannel, nsILoadInfo* aLoadInfo)
|
|||
return NS_ERROR_CONTENT_BLOCKED;
|
||||
}
|
||||
|
||||
if (nsMixedContentBlocker::sSendHSTSPriming) {
|
||||
rv = nsMixedContentBlocker::MarkLoadInfoForPriming(uri,
|
||||
requestingContext,
|
||||
aLoadInfo);
|
||||
return rv;
|
||||
}
|
||||
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -54,13 +54,6 @@ bool nsMixedContentBlocker::sBlockMixedScript = false;
|
|||
// Is mixed display content blocking (images, audio, video, <a ping>) enabled?
|
||||
bool nsMixedContentBlocker::sBlockMixedDisplay = false;
|
||||
|
||||
// Do we move HSTS before mixed-content
|
||||
bool nsMixedContentBlocker::sUseHSTS = false;
|
||||
// Do we send an HSTS priming request
|
||||
bool nsMixedContentBlocker::sSendHSTSPriming = false;
|
||||
// Default HSTS Priming failure timeout to 7 days, in seconds
|
||||
uint32_t nsMixedContentBlocker::sHSTSPrimingCacheTimeout = (60 * 24 * 7);
|
||||
|
||||
// Fired at the document that attempted to load mixed content. The UI could
|
||||
// handle this event, for example, by displaying an info bar that offers the
|
||||
// choice to reload the page with mixed content permitted.
|
||||
|
|
@ -202,18 +195,6 @@ nsMixedContentBlocker::nsMixedContentBlocker()
|
|||
// Cache the pref for mixed display blocking
|
||||
Preferences::AddBoolVarCache(&sBlockMixedDisplay,
|
||||
"security.mixed_content.block_display_content");
|
||||
|
||||
// Cache the pref for HSTS
|
||||
Preferences::AddBoolVarCache(&sUseHSTS,
|
||||
"security.mixed_content.use_hsts");
|
||||
|
||||
// Cache the pref for sending HSTS priming
|
||||
Preferences::AddBoolVarCache(&sSendHSTSPriming,
|
||||
"security.mixed_content.send_hsts_priming");
|
||||
|
||||
// Cache the pref for HSTS priming failure cache time
|
||||
Preferences::AddUintVarCache(&sHSTSPrimingCacheTimeout,
|
||||
"security.mixed_content.hsts_priming_cache_timeout");
|
||||
}
|
||||
|
||||
nsMixedContentBlocker::~nsMixedContentBlocker()
|
||||
|
|
@ -343,22 +324,6 @@ nsMixedContentBlocker::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
|
|||
return NS_BINDING_FAILED;
|
||||
}
|
||||
|
||||
if (nsMixedContentBlocker::sSendHSTSPriming) {
|
||||
// The LoadInfo passed in is for the original channel, HSTS priming needs to
|
||||
// be set on the new channel, if required. If the redirect changes
|
||||
// http->https, or vice-versa, the need for priming may change.
|
||||
nsCOMPtr<nsILoadInfo> newLoadInfo;
|
||||
rv = aNewChannel->GetLoadInfo(getter_AddRefs(newLoadInfo));
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
rv = nsMixedContentBlocker::MarkLoadInfoForPriming(newUri,
|
||||
requestingContext,
|
||||
newLoadInfo);
|
||||
if (NS_FAILED(rv)) {
|
||||
decision = REJECT_REQUEST;
|
||||
newLoadInfo->ClearHSTSPriming();
|
||||
}
|
||||
}
|
||||
|
||||
// If the channel is about to load mixed content, abort the channel
|
||||
if (!NS_CP_ACCEPTED(decision)) {
|
||||
autoCallback.DontCallback();
|
||||
|
|
@ -691,12 +656,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
|||
// the parent is https, and the protocol associated with innerContentLocation
|
||||
// doesn't map to the secure URI flags checked above. Assert this for
|
||||
// sanity's sake
|
||||
#ifdef DEBUG
|
||||
bool isHttpsScheme = false;
|
||||
rv = innerContentLocation->SchemeIs("https", &isHttpsScheme);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
MOZ_ASSERT(!isHttpsScheme);
|
||||
#endif
|
||||
*aDecision = REJECT_REQUEST;
|
||||
return NS_OK;
|
||||
}
|
||||
|
|
@ -836,34 +795,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
|||
}
|
||||
nsresult stateRV = securityUI->GetState(&state);
|
||||
|
||||
bool doHSTSPriming = false;
|
||||
if (isHttpScheme) {
|
||||
bool hsts = false;
|
||||
bool cached = false;
|
||||
nsCOMPtr<nsISiteSecurityService> sss =
|
||||
do_GetService(NS_SSSERVICE_CONTRACTID, &rv);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
rv = sss->IsSecureURI(nsISiteSecurityService::HEADER_HSTS, aContentLocation,
|
||||
0, &cached, &hsts);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
if (hsts && sUseHSTS) {
|
||||
// assume we will be upgraded later
|
||||
*aDecision = ACCEPT;
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
// Send a priming request if the result is not already cached and priming
|
||||
// requests are allowed
|
||||
if (!cached && sSendHSTSPriming) {
|
||||
// add this URI as a priming location
|
||||
doHSTSPriming = true;
|
||||
document->AddHSTSPrimingLocation(innerContentLocation,
|
||||
HSTSPrimingState::eHSTS_PRIMING_ALLOW);
|
||||
*aDecision = ACCEPT;
|
||||
}
|
||||
}
|
||||
|
||||
// At this point we know that the request is mixed content, and the only
|
||||
// question is whether we block it. Record telemetry at this point as to
|
||||
// whether HSTS would have fixed things by making the content location
|
||||
|
|
@ -879,14 +810,14 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
|||
bool active = (classification == eMixedScript);
|
||||
if (!aHadInsecureImageRedirect) {
|
||||
if (XRE_IsParentProcess()) {
|
||||
AccumulateMixedContentHSTS(innerContentLocation, active, doHSTSPriming);
|
||||
AccumulateMixedContentHSTS(innerContentLocation, active);
|
||||
} else {
|
||||
// Ask the parent process to do the same call
|
||||
mozilla::dom::ContentChild* cc = mozilla::dom::ContentChild::GetSingleton();
|
||||
if (cc) {
|
||||
mozilla::ipc::URIParams uri;
|
||||
SerializeURI(innerContentLocation, uri);
|
||||
cc->SendAccumulateMixedContentHSTS(uri, active, doHSTSPriming);
|
||||
cc->SendAccumulateMixedContentHSTS(uri, active);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -929,13 +860,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
|||
}
|
||||
}
|
||||
} else {
|
||||
if (doHSTSPriming) {
|
||||
document->AddHSTSPrimingLocation(innerContentLocation,
|
||||
HSTSPrimingState::eHSTS_PRIMING_BLOCK);
|
||||
*aDecision = nsIContentPolicy::ACCEPT;
|
||||
} else {
|
||||
*aDecision = nsIContentPolicy::REJECT_REQUEST;
|
||||
}
|
||||
*aDecision = nsIContentPolicy::REJECT_REQUEST;
|
||||
LogMixedContentMessage(classification, aContentLocation, rootDoc, eBlocked);
|
||||
if (!rootDoc->GetHasMixedDisplayContentBlocked() && NS_SUCCEEDED(stateRV)) {
|
||||
rootDoc->SetHasMixedDisplayContentBlocked(true);
|
||||
|
|
@ -981,13 +906,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
|
|||
}
|
||||
} else {
|
||||
//User has not overriden the pref by Disabling protection. Reject the request and update the security state.
|
||||
if (doHSTSPriming) {
|
||||
document->AddHSTSPrimingLocation(innerContentLocation,
|
||||
HSTSPrimingState::eHSTS_PRIMING_BLOCK);
|
||||
*aDecision = nsIContentPolicy::ACCEPT;
|
||||
} else {
|
||||
*aDecision = nsIContentPolicy::REJECT_REQUEST;
|
||||
}
|
||||
*aDecision = nsIContentPolicy::REJECT_REQUEST;
|
||||
LogMixedContentMessage(classification, aContentLocation, rootDoc, eBlocked);
|
||||
// See if the pref will change here. If it will, only then do we need to call OnSecurityChange() to update the UI.
|
||||
if (rootDoc->GetHasMixedActiveContentBlocked()) {
|
||||
|
|
@ -1052,24 +971,10 @@ enum MixedContentHSTSState {
|
|||
MCB_HSTS_ACTIVE_WITH_HSTS = 3
|
||||
};
|
||||
|
||||
// Similar to the existing mixed-content HSTS, except MCB_HSTS_*_NO_HSTS is
|
||||
// broken into two distinct states, indicating whether we plan to send a priming
|
||||
// request or not. If we decided not go send a priming request, it could be
|
||||
// because it is a type we do not support, or because we cached a previous
|
||||
// negative response.
|
||||
enum MixedContentHSTSPrimingState {
|
||||
eMCB_HSTS_PASSIVE_WITH_HSTS = 0,
|
||||
eMCB_HSTS_ACTIVE_WITH_HSTS = 1,
|
||||
eMCB_HSTS_PASSIVE_NO_PRIMING = 2,
|
||||
eMCB_HSTS_PASSIVE_DO_PRIMING = 3,
|
||||
eMCB_HSTS_ACTIVE_NO_PRIMING = 4,
|
||||
eMCB_HSTS_ACTIVE_DO_PRIMING = 5
|
||||
};
|
||||
|
||||
// Record information on when HSTS would have made mixed content not mixed
|
||||
// content (regardless of whether it was actually blocked)
|
||||
void
|
||||
nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive, bool aHasHSTSPriming)
|
||||
nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive)
|
||||
{
|
||||
// This method must only be called in the parent, because
|
||||
// nsSiteSecurityService is only available in the parent
|
||||
|
|
@ -1089,108 +994,26 @@ nsMixedContentBlocker::AccumulateMixedContentHSTS(nsIURI* aURI, bool aActive, bo
|
|||
return;
|
||||
}
|
||||
|
||||
// states: would upgrade, would prime, hsts info cached
|
||||
// states: would upgrade, hsts info cached
|
||||
// active, passive
|
||||
//
|
||||
if (!aActive) {
|
||||
if (!hsts) {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
|
||||
MCB_HSTS_PASSIVE_NO_HSTS);
|
||||
if (aHasHSTSPriming) {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_PASSIVE_DO_PRIMING);
|
||||
} else {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_PASSIVE_NO_PRIMING);
|
||||
}
|
||||
}
|
||||
else {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
|
||||
MCB_HSTS_PASSIVE_WITH_HSTS);
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_PASSIVE_WITH_HSTS);
|
||||
}
|
||||
} else {
|
||||
if (!hsts) {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
|
||||
MCB_HSTS_ACTIVE_NO_HSTS);
|
||||
if (aHasHSTSPriming) {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_ACTIVE_DO_PRIMING);
|
||||
} else {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_ACTIVE_NO_PRIMING);
|
||||
}
|
||||
}
|
||||
else {
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS,
|
||||
MCB_HSTS_ACTIVE_WITH_HSTS);
|
||||
Telemetry::Accumulate(Telemetry::MIXED_CONTENT_HSTS_PRIMING,
|
||||
eMCB_HSTS_ACTIVE_WITH_HSTS);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//static
|
||||
nsresult
|
||||
nsMixedContentBlocker::MarkLoadInfoForPriming(nsIURI* aURI,
|
||||
nsISupports* aRequestingContext,
|
||||
nsILoadInfo* aLoadInfo)
|
||||
{
|
||||
nsresult rv;
|
||||
bool sendPriming = false;
|
||||
bool mixedContentWouldBlock = false;
|
||||
rv = GetHSTSPrimingFromRequestingContext(aURI,
|
||||
aRequestingContext,
|
||||
&sendPriming,
|
||||
&mixedContentWouldBlock);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
if (sendPriming) {
|
||||
aLoadInfo->SetHSTSPriming(mixedContentWouldBlock);
|
||||
}
|
||||
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
//static
|
||||
nsresult
|
||||
nsMixedContentBlocker::GetHSTSPrimingFromRequestingContext(nsIURI* aURI,
|
||||
nsISupports* aRequestingContext,
|
||||
bool* aSendPrimingRequest,
|
||||
bool* aMixedContentWouldBlock)
|
||||
{
|
||||
*aSendPrimingRequest = false;
|
||||
*aMixedContentWouldBlock = false;
|
||||
// If we marked for priming, we used the innermost URI, so get that
|
||||
nsCOMPtr<nsIURI> innerURI = NS_GetInnermostURI(aURI);
|
||||
if (!innerURI) {
|
||||
NS_ERROR("Can't get innerURI from aContentLocation");
|
||||
return NS_ERROR_CONTENT_BLOCKED;
|
||||
}
|
||||
|
||||
bool isHttp = false;
|
||||
innerURI->SchemeIs("http", &isHttp);
|
||||
if (!isHttp) {
|
||||
// there is nothign to do
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
// If the DocShell was marked for HSTS priming, propagate that to the LoadInfo
|
||||
nsCOMPtr<nsIDocShell> docShell = NS_CP_GetDocShellFromContext(aRequestingContext);
|
||||
if (!docShell) {
|
||||
return NS_OK;
|
||||
}
|
||||
nsCOMPtr<nsIDocument> document = docShell->GetDocument();
|
||||
if (!document) {
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
HSTSPrimingState status = document->GetHSTSPrimingStateForLocation(innerURI);
|
||||
if (status != HSTSPrimingState::eNO_HSTS_PRIMING) {
|
||||
*aSendPrimingRequest = (status != HSTSPrimingState::eNO_HSTS_PRIMING);
|
||||
*aMixedContentWouldBlock = (status == HSTSPrimingState::eHSTS_PRIMING_BLOCK);
|
||||
}
|
||||
|
||||
return NS_OK;
|
||||
}
|
||||
}
|
||||
|
|
@ -62,44 +62,11 @@ public:
|
|||
nsIPrincipal* aRequestPrincipal,
|
||||
int16_t* aDecision);
|
||||
static void AccumulateMixedContentHSTS(nsIURI* aURI,
|
||||
bool aActive,
|
||||
bool aHasHSTSPriming);
|
||||
/* If the document associated with aRequestingContext requires priming for
|
||||
* aURI, propagate that to the LoadInfo so the HttpChannel will find out about
|
||||
* it.
|
||||
*
|
||||
* @param aURI The URI associated with the load
|
||||
* @param aRequestingContext the requesting context passed to ShouldLoad
|
||||
* @param aLoadInfo the LoadInfo for the load
|
||||
*/
|
||||
static nsresult MarkLoadInfoForPriming(nsIURI* aURI,
|
||||
nsISupports* aRequestingContext,
|
||||
nsILoadInfo* aLoadInfo);
|
||||
|
||||
/* Given a context, return whether HSTS was marked on the document associated
|
||||
* with the load for the given URI. This is used by MarkLoadInfoForPriming and
|
||||
* directly by the image loader to determine whether to allow a load to occur
|
||||
* from the cache.
|
||||
*
|
||||
* @param aURI The URI associated with the load
|
||||
* @param aRequestingContext the requesting context passed to ShouldLoad
|
||||
* @param aSendPrimingRequest out true if priming is required on the channel
|
||||
* @param aMixedContentWouldBlock out true if mixed content would block
|
||||
*/
|
||||
static nsresult GetHSTSPrimingFromRequestingContext(nsIURI* aURI,
|
||||
nsISupports* aRequestingContext,
|
||||
bool* aSendPrimingRequest,
|
||||
bool* aMixedContentWouldBlock);
|
||||
bool aActive);
|
||||
|
||||
|
||||
static bool sBlockMixedScript;
|
||||
static bool sBlockMixedDisplay;
|
||||
// Do we move HSTS before mixed-content
|
||||
static bool sUseHSTS;
|
||||
// Do we send an HSTS priming request
|
||||
static bool sSendHSTSPriming;
|
||||
// Default HSTS Priming failure timeout in seconds
|
||||
static uint32_t sHSTSPrimingCacheTimeout;
|
||||
};
|
||||
|
||||
#endif /* nsMixedContentBlocker_h___ */
|
||||
|
|
|
|||
|
|
@ -116,8 +116,6 @@ SimpleTest.waitForExplicitFinish();
|
|||
SpecialPowers.pushPrefEnv({
|
||||
'set': [['security.mixed_content.block_active_content', false],
|
||||
['security.mixed_content.block_display_content', false],
|
||||
['security.mixed_content.send_hsts_priming', false],
|
||||
['security.mixed_content.use_hsts', false],
|
||||
]
|
||||
},
|
||||
function() {
|
||||
|
|
|
|||
|
|
@ -1,19 +0,0 @@
|
|||
[DEFAULT]
|
||||
skip-if = debug # bug 1311599, bug 1311239, etc
|
||||
support-files =
|
||||
head.js
|
||||
file_priming-top.html
|
||||
file_testserver.sjs
|
||||
file_1x1.png
|
||||
file_priming.js
|
||||
file_stylesheet.css
|
||||
|
||||
[browser_hsts-priming_allow_active.js]
|
||||
[browser_hsts-priming_block_active.js]
|
||||
[browser_hsts-priming_hsts_after_mixed.js]
|
||||
[browser_hsts-priming_allow_display.js]
|
||||
[browser_hsts-priming_block_display.js]
|
||||
[browser_hsts-priming_block_active_css.js]
|
||||
[browser_hsts-priming_block_active_with_redir_same.js]
|
||||
[browser_hsts-priming_no-duplicates.js]
|
||||
[browser_hsts-priming_cache-timeout.js]
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when active
|
||||
* content is allowed.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "allow_active";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when display
|
||||
* content is allowed.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "allow_display";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when active
|
||||
* content is blocked.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_active";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when active
|
||||
* content is blocked for css.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_active_css";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when active
|
||||
* content is blocked and redirect to the same host should still upgrade.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_active_with_redir_same";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when display
|
||||
* content is blocked.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_display";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Test that the network.hsts_priming.cache_timeout preferene causes the cache
|
||||
* to timeout
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Observer.add_observers(Services);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_display";
|
||||
|
||||
SetupPrefTestEnvironment(which, [["security.mixed_content.hsts_priming_cache_timeout", 1]]);
|
||||
|
||||
yield execute_test("no-ssl", test_settings[which].mimetype);
|
||||
|
||||
let pre_promise = performance.now();
|
||||
|
||||
while ((performance.now() - pre_promise) < 2000) {
|
||||
yield new Promise(function (resolve) {
|
||||
setTimeout(resolve, 2000);
|
||||
});
|
||||
}
|
||||
|
||||
// clear the fact that we saw a priming request
|
||||
test_settings[which].priming = {};
|
||||
|
||||
yield execute_test("no-ssl", test_settings[which].mimetype);
|
||||
is(test_settings[which].priming["no-ssl"], true,
|
||||
"Correctly send a priming request after expiration.");
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Check that HSTS priming occurs correctly with mixed content when the
|
||||
* mixed-content blocks before HSTS.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
Services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "hsts_after_mixed";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
/*
|
||||
* Description of the test:
|
||||
* Only one request should be sent per host, even if we run the test more
|
||||
* than once.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
//jscs:disable
|
||||
add_task(function*() {
|
||||
//jscs:enable
|
||||
Observer.add_observers(Services);
|
||||
registerCleanupFunction(do_cleanup);
|
||||
|
||||
let which = "block_display";
|
||||
|
||||
SetupPrefTestEnvironment(which);
|
||||
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
test_settings[which].priming = {};
|
||||
|
||||
// run the tests twice to validate the cache is being used
|
||||
for (let server of Object.keys(test_servers)) {
|
||||
yield execute_test(server, test_settings[which].mimetype);
|
||||
}
|
||||
|
||||
SpecialPowers.popPrefEnv();
|
||||
});
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 17 KiB |
|
|
@ -1,84 +0,0 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<title>Bug 1246540</title>
|
||||
<meta http-equiv='content-type' content="text/html;charset=utf-8" />
|
||||
</head>
|
||||
<body>
|
||||
<p id="display"></p>
|
||||
<div id="content" style="visibility: hidden">
|
||||
</div>
|
||||
|
||||
<script type="text/javascript">
|
||||
/*
|
||||
* Description of the test:
|
||||
* Attempt to load an insecure resource. If the resource responds to HSTS
|
||||
* priming with an STS header, the load should continue securely.
|
||||
* If it does not, the load should continue be blocked or continue insecurely.
|
||||
*/
|
||||
|
||||
function parse_query_string() {
|
||||
var q = {};
|
||||
document.location.search.substr(1).
|
||||
split('&').forEach(function (item, idx, ar) {
|
||||
let [k, v] = item.split('=');
|
||||
q[k] = unescape(v);
|
||||
});
|
||||
return q;
|
||||
}
|
||||
|
||||
var args = parse_query_string();
|
||||
|
||||
var subresources = {
|
||||
css: { mimetype: 'text/css', file: 'file_stylesheet.css' },
|
||||
img: { mimetype: 'image/png', file: 'file_1x1.png' },
|
||||
script: { mimetype: 'text/javascript', file: 'file_priming.js' },
|
||||
};
|
||||
|
||||
function handler(ev) {
|
||||
console.log("HSTS_PRIMING: Blocked "+args.id);
|
||||
}
|
||||
|
||||
function loadCss(src) {
|
||||
let head = document.getElementsByTagName("head")[0];
|
||||
let link = document.createElement("link");
|
||||
link.setAttribute("rel", "stylesheet");
|
||||
link.setAttribute("type", subresources[args.type].mimetype);
|
||||
link.setAttribute("href", src);
|
||||
head.appendChild(link);
|
||||
}
|
||||
|
||||
function loadResource(src) {
|
||||
let content = document.getElementById("content");
|
||||
let testElem = document.createElement(args.type);
|
||||
testElem.setAttribute("id", args.id);
|
||||
testElem.setAttribute("charset", "UTF-8");
|
||||
testElem.onerror = handler;
|
||||
content.appendChild(testElem);
|
||||
testElem.src = src;
|
||||
}
|
||||
|
||||
function loadTest() {
|
||||
let subresource = subresources[args.type];
|
||||
|
||||
let src = "http://"
|
||||
+ args.host
|
||||
+ "/browser/dom/security/test/hsts/file_testserver.sjs"
|
||||
+ "?file=" +escape("browser/dom/security/test/hsts/" + subresource.file)
|
||||
+ "&primer=" + escape(args.id)
|
||||
+ "&mimetype=" + escape(subresource.mimetype)
|
||||
;
|
||||
if (args.type == 'css') {
|
||||
loadCss(src);
|
||||
return;
|
||||
}
|
||||
|
||||
loadResource(src);
|
||||
}
|
||||
|
||||
// start running the tests
|
||||
loadTest();
|
||||
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
function completed() {
|
||||
return;
|
||||
}
|
||||
completed();
|
||||
|
|
@ -1,66 +0,0 @@
|
|||
// SJS file for HSTS mochitests
|
||||
|
||||
Components.utils.import("resource://gre/modules/NetUtil.jsm");
|
||||
Components.utils.importGlobalProperties(["URLSearchParams"]);
|
||||
|
||||
function loadFromFile(path) {
|
||||
// Load the HTML to return in the response from file.
|
||||
// Since it's relative to the cwd of the test runner, we start there and
|
||||
// append to get to the actual path of the file.
|
||||
var testFile =
|
||||
Components.classes["@mozilla.org/file/directory_service;1"].
|
||||
getService(Components.interfaces.nsIProperties).
|
||||
get("CurWorkD", Components.interfaces.nsILocalFile);
|
||||
var dirs = path.split("/");
|
||||
for (var i = 0; i < dirs.length; i++) {
|
||||
testFile.append(dirs[i]);
|
||||
}
|
||||
var testFileStream =
|
||||
Components.classes["@mozilla.org/network/file-input-stream;1"].
|
||||
createInstance(Components.interfaces.nsIFileInputStream);
|
||||
testFileStream.init(testFile, -1, 0, 0);
|
||||
var test = NetUtil.readInputStreamToString(testFileStream, testFileStream.available());
|
||||
return test;
|
||||
}
|
||||
|
||||
function handleRequest(request, response)
|
||||
{
|
||||
const query = new URLSearchParams(request.queryString);
|
||||
|
||||
redir = query.get('redir');
|
||||
if (redir == 'same') {
|
||||
query.delete("redir");
|
||||
response.setStatus(302);
|
||||
let newURI = request.uri;
|
||||
newURI.queryString = query.serialize();
|
||||
response.setHeader("Location", newURI.spec)
|
||||
}
|
||||
|
||||
// avoid confusing cache behaviors
|
||||
response.setHeader("Cache-Control", "no-cache", false);
|
||||
|
||||
// if we have a priming header, check for required behavior
|
||||
// and set header appropriately
|
||||
if (request.hasHeader('Upgrade-Insecure-Requests')) {
|
||||
var expected = query.get('primer');
|
||||
if (expected == 'prime-hsts') {
|
||||
// set it for 5 minutes
|
||||
response.setHeader("Strict-Transport-Security", "max-age="+(60*5), false);
|
||||
} else if (expected == 'reject-upgrade') {
|
||||
response.setHeader("Strict-Transport-Security", "max-age=0", false);
|
||||
}
|
||||
response.write('');
|
||||
return;
|
||||
}
|
||||
|
||||
var file = query.get('file');
|
||||
if (file) {
|
||||
var mimetype = unescape(query.get('mimetype'));
|
||||
response.setHeader("Content-Type", mimetype, false);
|
||||
response.write(loadFromFile(unescape(file)));
|
||||
return;
|
||||
}
|
||||
|
||||
response.setHeader("Content-Type", "application/json", false);
|
||||
response.write('{}');
|
||||
}
|
||||
|
|
@ -1,308 +0,0 @@
|
|||
/*
|
||||
* Description of the tests:
|
||||
* Check that HSTS priming occurs correctly with mixed content
|
||||
*
|
||||
* This test uses three hostnames, each of which treats an HSTS priming
|
||||
* request differently.
|
||||
* * no-ssl never returns an ssl response
|
||||
* * reject-upgrade returns an ssl response, but with no STS header
|
||||
* * prime-hsts returns an ssl response with the appropriate STS header
|
||||
*
|
||||
* For each server, test that it response appropriately when the we allow
|
||||
* or block active or display content, as well as when we send an hsts priming
|
||||
* request, but do not change the order of mixed-content and HSTS.
|
||||
*
|
||||
* Test use http-on-examine-response, so must be run in browser context.
|
||||
*/
|
||||
'use strict';
|
||||
|
||||
var TOP_URI = "https://example.com/browser/dom/security/test/hsts/file_priming-top.html";
|
||||
|
||||
var test_servers = {
|
||||
// a test server that does not support TLS
|
||||
'no-ssl': {
|
||||
host: 'example.co.jp',
|
||||
response: false,
|
||||
id: 'no-ssl',
|
||||
},
|
||||
// a test server which does not support STS upgrade
|
||||
'reject-upgrade': {
|
||||
host: 'example.org',
|
||||
response: true,
|
||||
id: 'reject-upgrade',
|
||||
},
|
||||
// a test server when sends an STS header when priming
|
||||
'prime-hsts': {
|
||||
host: 'test1.example.com',
|
||||
response: true,
|
||||
id: 'prime-hsts'
|
||||
},
|
||||
};
|
||||
|
||||
var test_settings = {
|
||||
// mixed active content is allowed, priming will upgrade
|
||||
allow_active: {
|
||||
block_active: false,
|
||||
block_display: false,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'script',
|
||||
result: {
|
||||
'no-ssl': 'insecure',
|
||||
'reject-upgrade': 'insecure',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
// mixed active content is blocked, priming will upgrade
|
||||
block_active: {
|
||||
block_active: true,
|
||||
block_display: false,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'script',
|
||||
result: {
|
||||
'no-ssl': 'blocked',
|
||||
'reject-upgrade': 'blocked',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
// keep the original order of mixed-content and HSTS, but send
|
||||
// priming requests
|
||||
hsts_after_mixed: {
|
||||
block_active: true,
|
||||
block_display: false,
|
||||
use_hsts: false,
|
||||
send_hsts_priming: true,
|
||||
type: 'script',
|
||||
result: {
|
||||
'no-ssl': 'blocked',
|
||||
'reject-upgrade': 'blocked',
|
||||
'prime-hsts': 'blocked',
|
||||
},
|
||||
},
|
||||
// mixed display content is allowed, priming will upgrade
|
||||
allow_display: {
|
||||
block_active: true,
|
||||
block_display: false,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'img',
|
||||
result: {
|
||||
'no-ssl': 'insecure',
|
||||
'reject-upgrade': 'insecure',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
// mixed display content is blocked, priming will upgrade
|
||||
block_display: {
|
||||
block_active: true,
|
||||
block_display: true,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'img',
|
||||
result: {
|
||||
'no-ssl': 'blocked',
|
||||
'reject-upgrade': 'blocked',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
// mixed active content is blocked, priming will upgrade (css)
|
||||
block_active_css: {
|
||||
block_active: true,
|
||||
block_display: false,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'css',
|
||||
result: {
|
||||
'no-ssl': 'blocked',
|
||||
'reject-upgrade': 'blocked',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
// mixed active content is blocked, priming will upgrade
|
||||
// redirect to the same host
|
||||
block_active_with_redir_same: {
|
||||
block_active: true,
|
||||
block_display: false,
|
||||
use_hsts: true,
|
||||
send_hsts_priming: true,
|
||||
type: 'script',
|
||||
redir: 'same',
|
||||
result: {
|
||||
'no-ssl': 'blocked',
|
||||
'reject-upgrade': 'blocked',
|
||||
'prime-hsts': 'secure',
|
||||
},
|
||||
},
|
||||
}
|
||||
// track which test we are on
|
||||
var which_test = "";
|
||||
|
||||
const Observer = {
|
||||
observe: function (subject, topic, data) {
|
||||
switch (topic) {
|
||||
case 'console-api-log-event':
|
||||
return Observer.console_api_log_event(subject, topic, data);
|
||||
case 'http-on-examine-response':
|
||||
return Observer.http_on_examine_response(subject, topic, data);
|
||||
case 'http-on-modify-request':
|
||||
return Observer.http_on_modify_request(subject, topic, data);
|
||||
}
|
||||
throw "Can't handle topic "+topic;
|
||||
},
|
||||
add_observers: function (services) {
|
||||
services.obs.addObserver(Observer, "console-api-log-event", false);
|
||||
services.obs.addObserver(Observer, "http-on-examine-response", false);
|
||||
services.obs.addObserver(Observer, "http-on-modify-request", false);
|
||||
},
|
||||
// When a load is blocked which results in an error event within a page, the
|
||||
// test logs to the console.
|
||||
console_api_log_event: function (subject, topic, data) {
|
||||
var message = subject.wrappedJSObject.arguments[0];
|
||||
// when we are blocked, this will match the message we sent to the console,
|
||||
// ignore everything else.
|
||||
var re = RegExp(/^HSTS_PRIMING: Blocked ([-\w]+).*$/);
|
||||
if (!re.test(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
let id = message.replace(re, '$1');
|
||||
let curTest =test_servers[id];
|
||||
|
||||
if (!curTest) {
|
||||
ok(false, "HSTS priming got a console message blocked, "+
|
||||
"but doesn't match expectations "+id+" (msg="+message);
|
||||
return;
|
||||
}
|
||||
|
||||
is("blocked", test_settings[which_test].result[curTest.id], "HSTS priming "+
|
||||
which_test+":"+curTest.id+" expected "+
|
||||
test_settings[which_test].result[curTest.id]+", got blocked");
|
||||
test_settings[which_test].finished[curTest.id] = "blocked";
|
||||
},
|
||||
get_current_test: function(uri) {
|
||||
for (let item in test_servers) {
|
||||
let re = RegExp('https?://'+test_servers[item].host);
|
||||
if (re.test(uri)) {
|
||||
return test_servers[item];
|
||||
}
|
||||
}
|
||||
return null;
|
||||
},
|
||||
http_on_modify_request: function (subject, topic, data) {
|
||||
let channel = subject.QueryInterface(Ci.nsIHttpChannel);
|
||||
if (channel.requestMethod != 'HEAD') {
|
||||
return;
|
||||
}
|
||||
|
||||
let curTest = this.get_current_test(channel.URI.asciiSpec);
|
||||
|
||||
if (!curTest) {
|
||||
return;
|
||||
}
|
||||
|
||||
ok(!(curTest.id in test_settings[which_test].priming), "Already saw a priming request for " + curTest.id);
|
||||
test_settings[which_test].priming[curTest.id] = true;
|
||||
},
|
||||
// When we see a response come back, peek at the response and test it is secure
|
||||
// or insecure as needed. Addtionally, watch the response for priming requests.
|
||||
http_on_examine_response: function (subject, topic, data) {
|
||||
let channel = subject.QueryInterface(Ci.nsIHttpChannel);
|
||||
let curTest = this.get_current_test(channel.URI.asciiSpec);
|
||||
|
||||
if (!curTest) {
|
||||
return;
|
||||
}
|
||||
|
||||
let result = (channel.URI.asciiSpec.startsWith('https:')) ? "secure" : "insecure";
|
||||
|
||||
// This is a priming request, go ahead and validate we were supposed to see
|
||||
// a response from the server
|
||||
if (channel.requestMethod == 'HEAD') {
|
||||
is(true, curTest.response, "HSTS priming response found " + curTest.id);
|
||||
return;
|
||||
}
|
||||
|
||||
// This is the response to our query, make sure it matches
|
||||
is(result, test_settings[which_test].result[curTest.id],
|
||||
"HSTS priming result " + which_test + ":" + curTest.id);
|
||||
test_settings[which_test].finished[curTest.id] = result;
|
||||
},
|
||||
};
|
||||
|
||||
// opens `uri' in a new tab and focuses it.
|
||||
// returns the newly opened tab
|
||||
function openTab(uri) {
|
||||
let tab = gBrowser.addTab(uri);
|
||||
|
||||
// select tab and make sure its browser is focused
|
||||
gBrowser.selectedTab = tab;
|
||||
tab.ownerDocument.defaultView.focus();
|
||||
|
||||
return tab;
|
||||
}
|
||||
|
||||
function clear_sts_data() {
|
||||
for (let test in test_servers) {
|
||||
SpecialPowers.cleanUpSTSData('http://'+test_servers[test].host);
|
||||
}
|
||||
}
|
||||
|
||||
function do_cleanup() {
|
||||
clear_sts_data();
|
||||
|
||||
Services.obs.removeObserver(Observer, "console-api-log-event");
|
||||
Services.obs.removeObserver(Observer, "http-on-examine-response");
|
||||
}
|
||||
|
||||
function SetupPrefTestEnvironment(which, additional_prefs) {
|
||||
which_test = which;
|
||||
clear_sts_data();
|
||||
|
||||
var settings = test_settings[which];
|
||||
// priming counts how many priming requests we saw
|
||||
settings.priming = {};
|
||||
// priming counts how many tests were finished
|
||||
settings.finished= {};
|
||||
|
||||
var prefs = [["security.mixed_content.block_active_content",
|
||||
settings.block_active],
|
||||
["security.mixed_content.block_display_content",
|
||||
settings.block_display],
|
||||
["security.mixed_content.use_hsts",
|
||||
settings.use_hsts],
|
||||
["security.mixed_content.send_hsts_priming",
|
||||
settings.send_hsts_priming]];
|
||||
|
||||
if (additional_prefs) {
|
||||
for (let idx in additional_prefs) {
|
||||
prefs.push(additional_prefs[idx]);
|
||||
}
|
||||
}
|
||||
|
||||
console.log("prefs=%s", prefs);
|
||||
|
||||
SpecialPowers.pushPrefEnv({'set': prefs});
|
||||
}
|
||||
|
||||
// make the top-level test uri
|
||||
function build_test_uri(base_uri, host, test_id, type) {
|
||||
return base_uri +
|
||||
"?host=" + escape(host) +
|
||||
"&id=" + escape(test_id) +
|
||||
"&type=" + escape(type);
|
||||
}
|
||||
|
||||
// open a new tab, load the test, and wait for it to finish
|
||||
function execute_test(test, mimetype) {
|
||||
var src = build_test_uri(TOP_URI, test_servers[test].host,
|
||||
test, test_settings[which_test].type);
|
||||
|
||||
let tab = openTab(src);
|
||||
test_servers[test]['tab'] = tab;
|
||||
|
||||
let browser = gBrowser.getBrowserForTab(tab);
|
||||
yield BrowserTestUtils.browserLoaded(browser);
|
||||
|
||||
yield BrowserTestUtils.removeTab(tab);
|
||||
}
|
||||
|
|
@ -162,9 +162,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=62178
|
|||
}
|
||||
|
||||
function startTest() {
|
||||
// Set prefs to use mixed-content before HSTS
|
||||
SpecialPowers.pushPrefEnv({'set': [["security.mixed_content.use_hsts", false],
|
||||
["security.mixed_content.send_hsts_priming", false]]});
|
||||
//Set the first set of mixed content settings and increment the counter.
|
||||
changePrefs([], function() {
|
||||
//listen for a messages from the mixed content test harness
|
||||
|
|
|
|||
|
|
@ -28,5 +28,4 @@ BROWSER_CHROME_MANIFESTS += [
|
|||
'contentverifier/browser.ini',
|
||||
'csp/browser.ini',
|
||||
'general/browser.ini',
|
||||
'hsts/browser.ini',
|
||||
]
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue