File: insecure_form_util.h

package info (click to toggle)
chromium 139.0.7258.127-1
  • links: PTS, VCS
  • area: main
  • in suites:
  • size: 6,122,068 kB
  • sloc: cpp: 35,100,771; ansic: 7,163,530; javascript: 4,103,002; python: 1,436,920; asm: 946,517; xml: 746,709; pascal: 187,653; perl: 88,691; sh: 88,436; objc: 79,953; sql: 51,488; cs: 44,583; fortran: 24,137; makefile: 22,147; tcl: 15,277; php: 13,980; yacc: 8,984; ruby: 7,485; awk: 3,720; lisp: 3,096; lex: 1,327; ada: 727; jsp: 228; sed: 36
file content (52 lines) | stat: -rw-r--r-- 2,172 bytes parent folder | download | duplicates (6)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef COMPONENTS_SECURITY_INTERSTITIALS_CORE_INSECURE_FORM_UTIL_H_
#define COMPONENTS_SECURITY_INTERSTITIALS_CORE_INSECURE_FORM_UTIL_H_

#include "build/build_config.h"

class GURL;

namespace url {
class Origin;
}

namespace security_interstitials {

#if BUILDFLAG(IS_IOS)
// On iOS, EarlGrey tests can't serve a valid HTTPS response due to platform
// restrictions, so it's not possible to reliably use https:// URLs in Insecure
// Form Warning tests. Also, the test server serves URLs over 127.0.01 which is
// a trustworthy URL. This prevents serving a form over HTTPS and having it post
// to an insecure URL on iOS.
//
// To work around this, this function sets two ports for tests:
// - A form whose source URL's port is `source_url_port_treated_as_secure` will
//   be treated as an HTTPS URL in IsInsecureFormSourceAndAction().
// - A form whose action URL's port is `action_url_port_treated_as_insecure`
//   will be treated as an insecure URL in IsInsecureFormSourceAndAction().
//
// This allows us to use the test server on iOS and have the form's source and
// action URLs as 127.0.0.1:<port>.
void SetInsecureFormPortsForTesting(int source_url_port_treated_as_secure,
                                    int action_url_port_treated_as_insecure);
#endif

// Returns true if submitting a form with the given source and action urls is
// insecure.
// `source_origin` is the Origin of the page that submits the form.
// `action_url` is the URL of the form's action attribute.
bool IsInsecureFormActionOnSecureSource(const url::Origin& source_origin,
                                        const GURL& action_url);

// Returns true if submitting a form with the given action url is insecure.
// Matches the blink check for mixed content at
// blink::MixedContentChecker::IsMixedFormAction().
// `action_url` is the URL of the form's action attribute.
bool IsInsecureFormAction(const GURL& action_url);

}  // namespace security_interstitials

#endif  // COMPONENTS_SECURITY_INTERSTITIALS_CORE_INSECURE_FORM_UTIL_H_