Issue 2258013002: Flag for disabling the Application Cache in insecure contexts

Can't Edit
Can't Publish+Mail
Start Review

Created:
9 months, 4 weeks ago by jww

Modified:
9 months, 3 weeks ago

Reviewers:
michaeln

CC:
chromium-reviews, mlamouri+watch-content_chromium.org, tyoshino+watch_chromium.org, creis+watch_chromium.org, nasko+codewatch_chromium.org, jam (ooo 6-14 - 6-20), loading-reviews_chromium.org, dglazkov+blink, darin-cc_chromium.org, gavinp+loader_chromium.org, asvitkine+watch_chromium.org, blink-reviews, kinuko+watch, Nate Chapin, blink-reviews-api_chromium.org, Rick Byers, foolip, Mike West, jakearchibald

Base URL:
https://chromium.googlesource.com/chromium/src@master

Target Ref:
refs/pending/heads/master

Project:
chromium

Visibility:
Public.

More Reviews

Description

Flag for disabling the Application Cache in insecure contexts Implements a flag for disabling the Application Cache from loading a manifest or an origin from using the Application Cache APIs from insecure contexts. Also places this behavior behind the Strict Powerful Features flag. BUG=588931 [email protected]

Patch Set 1 #

Created: 9 months, 4 weeks ago

Download [raw] [tar.bz2]

	Unified diffs	Side-by-side diffs	Stats (+129 lines, -4 lines)			Patch
M	chrome/app/generated_resources.grd	View	1 chunk	+6 lines, -0 lines	0 comments	Download
M	chrome/browser/about_flags.cc	View	1 chunk	+4 lines, -0 lines	0 comments	Download
M	content/browser/renderer_host/render_view_host_impl.cc	View	1 chunk	+2 lines, -0 lines	0 comments	Download
M	content/public/common/content_features.h	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	content/public/common/content_features.cc	View	1 chunk	+4 lines, -0 lines	0 comments	Download
M	content/public/common/web_preferences.h	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	content/public/common/web_preferences.cc	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	content/renderer/render_view_impl.cc	View	1 chunk	+2 lines, -0 lines	0 comments	Download
A	third_party/WebKit/LayoutTests/http/tests/security/powerfulFeatureRestrictions/appcache-on-insecure-origin.html	View	1 chunk	+70 lines, -0 lines	0 comments	Download
A	third_party/WebKit/LayoutTests/http/tests/security/powerfulFeatureRestrictions/resources/manifest.manifest	View	1 chunk	+2 lines, -0 lines	0 comments	Download
M	third_party/WebKit/Source/core/frame/Settings.in	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	third_party/WebKit/Source/core/loader/appcache/ApplicationCache.cpp	View	2 chunks	+9 lines, -3 lines	0 comments	Download
M	third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.h	View	2 chunks	+3 lines, -0 lines	0 comments	Download
M	third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.cpp	View	4 chunks	+15 lines, -1 line	0 comments	Download
M	third_party/WebKit/Source/web/WebSettingsImpl.h	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	third_party/WebKit/Source/web/WebSettingsImpl.cpp	View	1 chunk	+5 lines, -0 lines	0 comments	Download
M	third_party/WebKit/public/web/WebSettings.h	View	1 chunk	+1 line, -0 lines	0 comments	Download
M	tools/metrics/histograms/histograms.xml	View	1 chunk	+1 line, -0 lines	0 comments	Download

Trybot results: Sign in to try more bots

Commit queue not available (can’t edit this change).

Messages

Total messages: 5 (0 generated)

Expand Messages | Collapse Messages

jww

Michael, can you take a look? This just creates the basic flag but disables it ...

9 months, 4 weeks ago (2016-08-19 00:29:31 UTC) #1

michaeln

To do this, we definitely have to make changes to content/browser/appcache so it doesn't read ...

9 months, 3 weeks ago (2016-08-19 23:24:02 UTC) #2

michaeln

Somethings that have to happen for this, in no particular order. * Sometime lazily after ...

9 months, 3 weeks ago (2016-08-19 23:58:18 UTC) #3

jww

Thanks for the pointers! I think we need to have Blink logic for doing the ...

9 months, 3 weeks ago (2016-08-20 00:13:50 UTC) #4

jww

9 months, 3 weeks ago (2016-08-20 00:13:51 UTC) #5

Thanks for the pointers! I think we need to have Blink logic for doing the
isSecureContext check, but I'll take a look at your references in the
meantime.

On Fri, Aug 19, 2016, 4:58 PM <[email protected]> wrote:

> Somethings that have to happen for this, in no particular order.
>
> * Sometime lazily after startup, all insecure origins in
> appcache_service()->storage()->usage_map() should be scheduled for
> deletion via
> DeleteAppCachesForOrigin. AppCacheServiceImpl can do that.
>
> * AppCacheInterceptor should not hook http requests
>
> * IsSchemeSupportedForAppCache() should examine the new flag
>
> Not sure that's all of it, but that would be a good start.
>
> https://codereview.chromium.org/2258013002/
>

-- 
You received this message because you are subscribed to the Google Groups
"Chromium-reviews" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].

Expand Messages | Collapse Messages