Changeset 51977 in webkit

Timestamp:

Dec 10, 2009 7:12:04 PM (14 years ago)

Author:

abarth@webkit.org

Message:

2009-12-10 Adam Barth <​abarth@webkit.org>

Reviewed by Darin Adler.

Mixed content shouldn't trigger for plug-ins without URLs
​https://bugs.webkit.org/show_bug.cgi?id=32384

• http/tests/security/mixedContent/empty-url-plugin-in-frame-expected.txt: Added.
• http/tests/security/mixedContent/empty-url-plugin-in-frame.html: Added.
• http/tests/security/mixedContent/resources/frame-with-empty-url-plugin.html: Added.

2009-12-10 Adam Barth <​abarth@webkit.org>

Reviewed by Darin Adler.

Mixed content shouldn't trigger for plug-ins without URLs
​https://bugs.webkit.org/show_bug.cgi?id=32384

These plug-ins cannot be controlled by active network attackers, so
there's no reason to trigger a mixed content warning.

Test: http/tests/security/mixedContent/empty-url-plugin-in-frame.html

• loader/FrameLoader.cpp: (WebCore::FrameLoader::isMixedContent):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/tests/security/mixedContent/empty-url-plugin-in-frame-expected.txt (added)
• LayoutTests/http/tests/security/mixedContent/empty-url-plugin-in-frame.html (added)
• LayoutTests/http/tests/security/mixedContent/resources/frame-with-empty-url-plugin.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/loader/FrameLoader.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Mixed content shouldn't trigger for plug-ins without URLs
+        https://bugs.webkit.org/show_bug.cgi?id=32384
+
+        * http/tests/security/mixedContent/empty-url-plugin-in-frame-expected.txt: Added.
+        * http/tests/security/mixedContent/empty-url-plugin-in-frame.html: Added.
+        * http/tests/security/mixedContent/resources/frame-with-empty-url-plugin.html: Added.
+
 2009-12-10  Oliver Hunt  <oliver@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Mixed content shouldn't trigger for plug-ins without URLs
+        https://bugs.webkit.org/show_bug.cgi?id=32384
+
+        These plug-ins cannot be controlled by active network attackers, so
+        there's no reason to trigger a mixed content warning.
+
+        Test: http/tests/security/mixedContent/empty-url-plugin-in-frame.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+
 2009-12-10  Alexey Proskuryakov  <ap@apple.com>
 

trunk/WebCore/loader/FrameLoader.cpp

@@ -1383 +1383 @@
         return false;  // We only care about HTTPS security origins.
 
-    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+    if (!url.isValid() || url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
         return false;  // Loading these protocols is secure.