Added mixed content check for *.onion origins. #15436

boocmp · 2022-10-12T13:36:17Z

Resolves brave/brave-browser#25939

Submitter Checklist:

I confirm that no security/privacy review is needed, or that I have requested one
There is a ticket for my issue
Used Github auto-closing keywords in the PR description above
Wrote a good PR/commit description
Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
Ran git rebase master (if needed)

Reviewer Checklist:

A security review is not needed, or a link to one is included in the PR description
New files have MPL-2.0 license header
Adequate test coverage exists to prevent regressions
Major classes, functions and non-trivial code blocks are well-commented
Changes in component dependencies are properly reflected in gn
Code follows the style guide
Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

goodov · 2022-10-12T14:35:16Z

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.cc

+  // Treat .onions as https://
+  // onion -> https: not blocked
+  // onion -> http: blocked
+  return IsMixedContent("https", resource_url);


url::kHttpsScheme

diracdeltas · 2022-10-12T15:31:23Z

browser/brave_content_browser_client_browsertest.cc

+  }
+  {
+    content::WebContentsConsoleObserver console_observer(contents);
+    ASSERT_FALSE(content::ExecJs(contents, "fetch('https://example.onion')"));


could you also add a test that images like <img src="http://example.com/favicon.jpg"> are blocked but not if it's example.onion?

actually this probably needs an example URL that doesn't support https at all (http://example.com can be upgraded to HTTPS). so something like <img src="http://http.badssl.com/favicon.ico">`

In this test I'm using embedded_test_server() it supports http only.

i originally wrote https but fixed it - now these URLs are all http. or do you mean if http://http.badssl.com/favicon.ico redirects to HTTPS, it wouldn't work for the test server for some reason?

diracdeltas · 2022-10-12T15:32:36Z

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.cc

+
+  if (!security_origin->Host().EndsWith(kOnion))
+    return absl::nullopt;
+


please also check here that security_origin scheme is either http or https.

(mixed content checking should only happen if scheme is http/https)

diracdeltas · 2022-10-12T15:35:55Z

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.cc

+  if (!security_origin->Host().EndsWith(kOnion))
+    return absl::nullopt;
+
+  if (resource_url.Host().EndsWith(kOnion)) {


should also check here if resource_url scheme is http or https.

actually i would just recommend a separate method isOnion or something, which checks that:

hostname ends with .onion

scheme is http or https

since the same check must be applied to both security_origin and resource_url

diracdeltas · 2022-10-12T15:46:49Z

suggested test plan for qa:

go to http://xao2lxsmia2edq2n5zxg6uahx6xox2t7bfjw6b5vdzsxi7ezmqob6qid.onion/ in tor window
open devtools, enter fetch("https://www.example.com"). In the Network tab, you can see the request to https://www.example.com is not blocked.
repeat step 2 but change https to http; it should be blocked
go to https://brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion/index.html. repeat steps 2-3
visit https://mixed.badssl.com/ and verify that it shows warning messages in the console about an insecure resource being requested (but was upgraded)
go to https://mixed-favicon.badssl.com/ and verify it shows error message in the console about favicon being blocked
verify https://mixed-form.badssl.com/ also shows a console warning
verify https://mixed-script.badssl.com/ shows up with a grey background and has an error message in the console
verify https://very.badssl.com/ shows both warnings and errors in the console

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.h

browser/brave_content_browser_client_browsertest.cc

kdenhartog · 2022-10-12T21:51:02Z

Looks like this one would close brave/brave-browser#25939 and brave/brave-browser#1135 from what I'm seeing

diracdeltas · 2022-10-13T02:13:12Z

i don't think it would close brave/brave-browser#1135 since there's more to secure origins than just mixed content (geolocation allowed, etc.)

kdenhartog · 2022-10-13T09:37:52Z

Thank you for the correction, I wasn't aware of that aspect of secure origins so seems like I've got some new "known unknowns" to read up on.

test/data/onion_upgradable.html

browser/brave_content_browser_client_browsertest.cc

diracdeltas · 2022-10-13T18:18:00Z

browser/brave_content_browser_client_browsertest.cc

+  }
+  {
+    content::WebContentsConsoleObserver console_observer(contents);
+    ASSERT_FALSE(content::ExecJs(contents, "fetch('http://example.onion')"));


also should change this to an onion site that sends access-control-allow-origin: *, ex: http://static01.nyt2sl3njavkomjxqe2e5nz6bsqv56yqbwkvhpmfn5jwh4pyccmjibad.onion/ads/tpc-check.html

fmarier · 2022-10-14T02:59:01Z

I created two test pages to confirm that the Tor Browser behaves as we expected (it does):

To run this test, I had to customize the following in Tor Browser:

dom.security.https_only_mode=false
security.mixed_content.block_display_content=true

diracdeltas · 2022-10-14T04:33:19Z

@fmarier awesome! did you test the mixed content autoupgrade case? (i.e., secure page embeds an HTTP image that supports HTTPS. in chrome it should autoupgrade the request to HTTPS. you can try with this URL: http://mixed.badssl.com/image.jpg.)

i'm guessing tor browser doesn't do the autoupgrade, but might be nice to have in brave.

fmarier · 2022-10-26T03:24:46Z

i'm guessing tor browser doesn't do the autoupgrade, but might be nice to have in brave.

The Tor Browser is actually running with HTTPS-only mode now (like Firefox private browsing I believe). I had to explicitly disable that feature in order to see the behavior of the mixed content blocker :)

arthuredelstein · 2022-10-27T05:15:36Z

i'm guessing tor browser doesn't do the autoupgrade, but might be nice to have in brave.

The Tor Browser is actually running with HTTPS-only mode now (like Firefox private browsing I believe). I had to explicitly disable that feature in order to see the behavior of the mixed content blocker :)

HTTPS-Only Mode (HOM) in Tor Windows only enforces HTTPS on top-level (non-onion) domains, so it's a good idea to make sure that, when HOM is enabled, the mixed-content blocker blocks the loading of insecure (HTTP, non-onion images) on http://[address].onion pages.

(FWIW, Firefox private browsing actually runs HTTPS-by-Default, which is somewhat weaker than HTTPS-Only Mode.)

chromium_src/content/browser/renderer_host/mixed_content_navigation_throttle.cc

diracdeltas · 2022-10-28T18:42:59Z

this is pretty much good to go for me except i think this test page should not have the <meta> policy: https://github.com/brave/brave-core/pull/15436/files#r994963774

any other concerns @fmarier @arthuredelstein ?

arthuredelstein · 2022-10-28T18:46:51Z

Looks good to me. Thanks @boocmp !

fmarier · 2022-10-28T21:09:26Z

browser/brave_content_browser_client_browsertest.cc

+  }
+  {
+    content::WebContentsConsoleObserver console_observer(contents);
+    const GURL resource_url =


This line seems unnecessary since we're not using resource_url in this block.

fmarier · 2022-10-28T21:11:35Z

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.h

+
+// We are hiding IsMixedContent(const String& origin_protocol, const KURL&)
+// because we want to enforce mixed content checks on .onion origins.
+// Publically available protocol-only overload of this method allows to skip


typo: "Publicly"

boocmp · 2022-10-31T13:36:44Z

this is pretty much good to go for me except i think this test page should not have the <meta> policy: https://github.com/brave/brave-core/pull/15436/files#r994963774

I don't know how to configure embedded http test server to support "upgrade-insecure-requests", The client request contains "upgrade-insecure-requests: 1" header, but without meta tag it doesn't work. It works only on embedded https server.

diracdeltas · 2022-10-31T23:52:13Z

this is pretty much good to go for me except i think this test page should not have the <meta> policy: https://github.com/brave/brave-core/pull/15436/files#r994963774

I don't know how to configure embedded http test server to support "upgrade-insecure-requests", The client request contains "upgrade-insecure-requests: 1" header, but without meta tag it doesn't work. It works only on embedded https server.

oh i see, the problem is that the test server is HTTP.

assuming there is no way to run an HTTPS test server, this is fine as-is assuming @fmarier has a test case for QA with autoupgrading mixed content.

diracdeltas · 2022-11-07T21:12:04Z

should be ok to merge?

patches/third_party-blink-renderer-core-loader-mixed_content_checker.h.patch

chromium_src/third_party/blink/renderer/platform/loader/fetch/https_state.cc

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.cc

goodov · 2022-11-08T08:24:00Z

browser/brave_content_browser_client_browsertest.cc

+  {
+    content::WebContentsConsoleObserver console_observer(contents);
+    ASSERT_FALSE(content::ExecJs(contents, "fetch('https://example.com')"));
+    EXPECT_TRUE(console_observer.messages().empty());


this observer doesn't wait for messages. Does this line check anything at all?

goodov · 2022-11-09T13:44:12Z

browser/brave_content_browser_client_browsertest.cc

@@ -98,6 +100,11 @@ class BraveContentBrowserClientTest : public InProcessBrowserTest {
        "brave_webtorrent.html?chrome://settings");
  }

+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    InProcessBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch("ignore-certificate-errors");


please replace this with content::ContentMockCertVerifier.
see for details: https://bravesoftware.slack.com/archives/C7VLGSR55/p1636702893335800

boocmp requested review from diracdeltas and goodov October 12, 2022 13:36

boocmp requested review from a team as code owners October 12, 2022 13:36

github-actions bot assigned boocmp Oct 12, 2022

goodov reviewed Oct 12, 2022

View reviewed changes

diracdeltas mentioned this pull request Oct 12, 2022

[hackerone] block mixed content on .onion sites brave/brave-browser#25939

Closed

diracdeltas reviewed Oct 12, 2022

View reviewed changes

chromium_src/third_party/blink/renderer/core/loader/mixed_content_checker.h Show resolved Hide resolved

diracdeltas requested a review from fmarier October 12, 2022 15:55

fmarier reviewed Oct 12, 2022

View reviewed changes

browser/brave_content_browser_client_browsertest.cc Show resolved Hide resolved

boocmp force-pushed the issues/1135 branch 2 times, most recently from 730b03e to 352b6e4 Compare October 13, 2022 09:03

boocmp force-pushed the issues/1135 branch 2 times, most recently from 3185d94 to 4fdae91 Compare October 13, 2022 14:59

boocmp requested review from fmarier, diracdeltas and goodov October 13, 2022 15:04

diracdeltas reviewed Oct 13, 2022

View reviewed changes

test/data/onion_upgradable.html Show resolved Hide resolved

diracdeltas reviewed Oct 13, 2022

View reviewed changes

browser/brave_content_browser_client_browsertest.cc Outdated Show resolved Hide resolved

diracdeltas reviewed Oct 13, 2022

View reviewed changes

diracdeltas requested a review from arthuredelstein October 14, 2022 17:15

boocmp force-pushed the issues/1135 branch from dab1495 to f84e458 Compare October 26, 2022 13:10

diracdeltas reviewed Oct 28, 2022

View reviewed changes

chromium_src/content/browser/renderer_host/mixed_content_navigation_throttle.cc Show resolved Hide resolved

fmarier approved these changes Oct 28, 2022

View reviewed changes

boocmp force-pushed the issues/1135 branch from f84e458 to 87b97c0 Compare October 31, 2022 14:19

diracdeltas approved these changes Oct 31, 2022

View reviewed changes

boocmp force-pushed the issues/1135 branch from 87b97c0 to dc15bb2 Compare November 1, 2022 12:00

goodov reviewed Nov 8, 2022

View reviewed changes

boocmp added 6 commits November 9, 2022 20:36

Added mixed content check for *.onion origins.

1b13f28

Review issues are addressed.

924fe08

CORS headers added.

163d46a

Fixed CORS.

7d71888

Added check for ws:// & wss:// protocols.

c6b1332

Fixed auto upgrade http->https.

2723c26

boocmp force-pushed the issues/1135 branch from dc15bb2 to b606907 Compare November 9, 2022 13:37

boocmp enabled auto-merge (squash) November 9, 2022 13:37

goodov reviewed Nov 9, 2022

View reviewed changes

Review issues are addressed.

200ca18

boocmp force-pushed the issues/1135 branch from b606907 to 200ca18 Compare November 9, 2022 15:11

goodov approved these changes Nov 10, 2022

View reviewed changes

boocmp merged commit c5cdfbb into master Nov 10, 2022

boocmp deleted the issues/1135 branch November 10, 2022 07:23

github-actions bot added this to the 1.47.x - Nightly milestone Nov 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added mixed content check for *.onion origins. #15436

Added mixed content check for *.onion origins. #15436

boocmp commented Oct 12, 2022 •

edited

Loading

goodov Oct 12, 2022

diracdeltas Oct 12, 2022 •

edited

Loading

diracdeltas Oct 12, 2022

boocmp Oct 12, 2022

diracdeltas Oct 12, 2022

diracdeltas Oct 12, 2022

diracdeltas Oct 12, 2022 •

edited

Loading

diracdeltas Oct 12, 2022

diracdeltas commented Oct 12, 2022 •

edited

Loading

kdenhartog commented Oct 12, 2022

diracdeltas commented Oct 13, 2022

kdenhartog commented Oct 13, 2022

diracdeltas Oct 13, 2022 •

edited

Loading

fmarier commented Oct 14, 2022 •

edited

Loading

diracdeltas commented Oct 14, 2022

fmarier commented Oct 26, 2022

arthuredelstein commented Oct 27, 2022 •

edited

Loading

diracdeltas commented Oct 28, 2022

arthuredelstein commented Oct 28, 2022

fmarier Oct 28, 2022

fmarier Oct 28, 2022

boocmp commented Oct 31, 2022

diracdeltas commented Oct 31, 2022

diracdeltas commented Nov 7, 2022

goodov Nov 8, 2022 •

edited

Loading

goodov Nov 9, 2022


		if (!security_origin->Host().EndsWith(kOnion))
		return absl::nullopt;

Added mixed content check for *.onion origins. #15436

Added mixed content check for *.onion origins. #15436

Conversation

boocmp commented Oct 12, 2022 • edited Loading

Submitter Checklist:

Reviewer Checklist:

After-merge Checklist:

Test Plan:

Choose a reason for hiding this comment

diracdeltas Oct 12, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

diracdeltas Oct 12, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

diracdeltas commented Oct 12, 2022 • edited Loading

kdenhartog commented Oct 12, 2022

diracdeltas commented Oct 13, 2022

kdenhartog commented Oct 13, 2022

diracdeltas Oct 13, 2022 • edited Loading

Choose a reason for hiding this comment

fmarier commented Oct 14, 2022 • edited Loading

diracdeltas commented Oct 14, 2022

fmarier commented Oct 26, 2022

arthuredelstein commented Oct 27, 2022 • edited Loading

diracdeltas commented Oct 28, 2022

arthuredelstein commented Oct 28, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

boocmp commented Oct 31, 2022

diracdeltas commented Oct 31, 2022

diracdeltas commented Nov 7, 2022

goodov Nov 8, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

boocmp commented Oct 12, 2022 •

edited

Loading

diracdeltas Oct 12, 2022 •

edited

Loading

diracdeltas Oct 12, 2022 •

edited

Loading

diracdeltas commented Oct 12, 2022 •

edited

Loading

diracdeltas Oct 13, 2022 •

edited

Loading

fmarier commented Oct 14, 2022 •

edited

Loading

arthuredelstein commented Oct 27, 2022 •

edited

Loading

goodov Nov 8, 2022 •

edited

Loading