diff options
Diffstat (limited to '')
51 files changed, 3359 insertions, 0 deletions
diff --git a/dom/security/test/https-only/browser.toml b/dom/security/test/https-only/browser.toml new file mode 100644 index 0000000000..2cba418aff --- /dev/null +++ b/dom/security/test/https-only/browser.toml @@ -0,0 +1,62 @@ +[DEFAULT] +prefs = ["dom.security.https_first=false"] + +["browser_background_redirect.js"] +support-files = ["file_background_redirect.sjs"] + +["browser_bug1874801.js"] +support-files = [ + "file_bug1874801.sjs", + "file_bug1874801.html", +] + +["browser_console_logging.js"] +support-files = ["file_console_logging.html"] + +["browser_continue_button_delay.js"] + +["browser_cors_mixedcontent.js"] +support-files = ["file_cors_mixedcontent.html"] + +["browser_hsts_host.js"] +support-files = [ + "hsts_headers.sjs", + "file_fragment_noscript.html", +] + +["browser_httpsonly_prefs.js"] + +["browser_httpsonly_speculative_connect.js"] +support-files = ["file_httpsonly_speculative_connect.html"] + +["browser_iframe_test.js"] +skip-if = [ + "os == 'linux' && bits == 64", # Bug 1735565 + "os == 'win' && bits == 64", # Bug 1735565 +] +support-files = ["file_iframe_test.sjs"] + +["browser_navigation.js"] +support-files = ["file_redirect_to_insecure.sjs"] + +["browser_redirect_tainting.js"] +support-files = ["file_redirect_tainting.sjs"] + +["browser_save_as.js"] +support-files = ["file_save_as.html"] + +["browser_triggering_principal_exemption.js"] + +["browser_upgrade_exceptions.js"] + +["browser_upgrade_exemption.js"] + +["browser_user_gesture.js"] +support-files = ["file_user_gesture.html"] + +["browser_websocket_exceptions.js"] +skip-if = ["os == 'android'"] # WebSocket tests are not supported on Android Yet. Bug 1566168. +support-files = [ + "file_websocket_exceptions.html", + "file_websocket_exceptions_iframe.html", +] diff --git a/dom/security/test/https-only/browser_background_redirect.js b/dom/security/test/https-only/browser_background_redirect.js new file mode 100644 index 0000000000..2907278943 --- /dev/null +++ b/dom/security/test/https-only/browser_background_redirect.js @@ -0,0 +1,64 @@ +"use strict"; +/* Description of the test: + * We load a page which gets upgraded to https. HTTPS-Only Mode then + * sends an 'http' background request which we redirect (using the + * web extension API) to 'same-origin' https. We ensure the HTTPS-Only + * Error page does not occur, but we https page gets loaded. + */ + +let extension = null; + +add_task(async function test_https_only_background_request_redirect() { + // A longer timeout is necessary for this test since we have to wait + // at least 3 seconds for the https-only background request to happen. + requestLongerTimeout(10); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + extension = ExtensionTestUtils.loadExtension({ + manifest: { + permissions: ["webRequest", "webRequestBlocking", "http://example.com/*"], + }, + background() { + let { browser } = this; + browser.webRequest.onBeforeRequest.addListener( + details => { + if (details.url === "http://example.com/") { + browser.test.sendMessage("redir-handled"); + let redirectUrl = "https://example.com/"; + return { redirectUrl }; + } + return undefined; + }, + { urls: ["http://example.com/*"] }, + ["blocking"] + ); + }, + }); + + await extension.startup(); + + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + let loaded = BrowserTestUtils.browserLoaded(browser, false, null, true); + BrowserTestUtils.startLoadingURIString( + browser, + "http://example.com/browser/dom/security/test/https-only/file_background_redirect.sjs?start" + ); + + await extension.awaitMessage("redir-handled"); + + await loaded; + + await SpecialPowers.spawn(browser, [], async function () { + let innerHTML = content.document.body.innerHTML; + ok( + innerHTML.includes("Test Page for Bug 1683015 loaded"), + "No https-only error page" + ); + }); + }); + + await extension.unload(); +}); diff --git a/dom/security/test/https-only/browser_bug1874801.js b/dom/security/test/https-only/browser_bug1874801.js new file mode 100644 index 0000000000..280a072736 --- /dev/null +++ b/dom/security/test/https-only/browser_bug1874801.js @@ -0,0 +1,56 @@ +/* Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +// Specifically test https://bugzilla.mozilla.org/show_bug.cgi?id=1874801 + +const TAB_URL = + "https://example.com/browser/dom/security/test/https-only/file_bug1874801.html"; + +function assertImageLoaded(tab) { + return ContentTask.spawn(tab.linkedBrowser, {}, () => { + const img = content.document.getElementsByTagName("img")[0]; + + ok(!!img, "Image tag should exist"); + ok(img.complete && img.naturalWidth > 0, "Image should have loaded "); + }); +} + +add_task(async function test_bug1874801() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["security.mixed_content.upgrade_display_content", false], + ["dom.security.https_first", true], + ["dom.security.https_only_mode", true], + ], + }); + + // Open Tab + const tabToClose = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + TAB_URL, + true + ); + + // Make sure the image was loaded via HTTPS + await assertImageLoaded(tabToClose); + + // Close Tab + const tabClosePromise = + BrowserTestUtils.waitForSessionStoreUpdate(tabToClose); + BrowserTestUtils.removeTab(tabToClose); + await tabClosePromise; + + // Restore Tab + const restoredTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + TAB_URL, + true + ); + undoCloseTab(); + const restoredTab = await restoredTabPromise; + + // Make sure the image was loaded via HTTPS + await assertImageLoaded(restoredTab); +}); diff --git a/dom/security/test/https-only/browser_console_logging.js b/dom/security/test/https-only/browser_console_logging.js new file mode 100644 index 0000000000..d648c27289 --- /dev/null +++ b/dom/security/test/https-only/browser_console_logging.js @@ -0,0 +1,153 @@ +// Bug 1625448 - HTTPS Only Mode - Tests for console logging +// https://bugzilla.mozilla.org/show_bug.cgi?id=1625448 +// This test makes sure that the various console messages from the HTTPS-Only +// mode get logged to the console. +"use strict"; + +// Test Cases +// description: Description of what the subtests expects. +// expectLogLevel: Expected log-level of a message. +// expectIncludes: Expected substrings the message should contain. +let tests = [ + { + description: "Top-Level upgrade should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: [ + "HTTPS-Only Mode: Upgrading insecure request", + "to use", + "file_console_logging.html", + ], + }, + { + description: "iFrame upgrade failure should get logged", + expectLogLevel: Ci.nsIConsoleMessage.error, + expectIncludes: [ + "HTTPS-Only Mode: Upgrading insecure request", + "failed", + "file_console_logging.html", + ], + }, + { + description: "WebSocket upgrade should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: [ + "HTTPS-Only Mode: Upgrading insecure request", + "to use", + "ws://does.not.exist", + ], + }, + { + description: "Sub-Resource upgrade for file_1 should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: ["Upgrading insecure", "request", "file_1.jpg"], + }, + { + description: "Sub-Resource upgrade for file_2 should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: ["Upgrading insecure", "request", "to use", "file_2.jpg"], + }, + { + description: "Exempt request for file_exempt should get logged", + expectLogLevel: Ci.nsIConsoleMessage.info, + expectIncludes: [ + "Not upgrading insecure request", + "because it is exempt", + "file_exempt.jpg", + ], + }, + { + description: "Sub-Resource upgrade failure for file_2 should get logged", + expectLogLevel: Ci.nsIConsoleMessage.error, + expectIncludes: ["Upgrading insecure request", "failed", "file_2.jpg"], + }, +]; + +const testPathUpgradeable = getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://example.com" +); +// DNS errors are not logged as HTTPS-Only Mode upgrade failures, so we have to +// upgrade to a domain that exists but fails. +const testPathNotUpgradeable = getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://self-signed.example.com" +); +const kTestURISuccess = testPathUpgradeable + "file_console_logging.html"; +const kTestURIFail = testPathNotUpgradeable + "file_console_logging.html"; +const kTestURIExempt = testPathUpgradeable + "file_exempt.jpg"; + +const UPGRADE_DISPLAY_CONTENT = + "security.mixed_content.upgrade_display_content"; + +add_task(async function () { + // A longer timeout is necessary for this test than the plain mochitests + // due to opening a new tab with the web console. + requestLongerTimeout(4); + + // Enable HTTPS-Only Mode and register console-listener + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + Services.console.registerListener(on_new_message); + // 1. Upgrade page to https:// + BrowserTestUtils.startLoadingURIString( + gBrowser.selectedBrowser, + kTestURISuccess + ); + // 2. Make an exempt http:// request + let xhr = new XMLHttpRequest(); + xhr.open("GET", kTestURIExempt, true); + xhr.channel.loadInfo.httpsOnlyStatus |= Ci.nsILoadInfo.HTTPS_ONLY_EXEMPT; + xhr.send(); + // 3. Make Websocket request + new WebSocket("ws://does.not.exist"); + + await BrowserTestUtils.waitForCondition(() => tests.length === 0); + + // Clean up + Services.console.unregisterListener(on_new_message); +}); + +function on_new_message(msgObj) { + const message = msgObj.message; + const logLevel = msgObj.logLevel; + + // Bools about message and pref + const isMCL2Enabled = Services.prefs.getBoolPref(UPGRADE_DISPLAY_CONTENT); + const isHTTPSOnlyModeLog = message.includes("HTTPS-Only Mode:"); + const isMCLog = message.includes("Mixed Content:"); + + // Check for messages about HTTPS-only upgrades (those should be unrelated to mixed content upgrades) + // or for mixed content upgrades which should only occur if security.mixed_content.upgrade_display_content is enabled + // (unrelated to https-only logs). + if ( + (isHTTPSOnlyModeLog && !isMCLog) || + (isMCLog && isMCL2Enabled && !isHTTPSOnlyModeLog) + ) { + for (let i = 0; i < tests.length; i++) { + const testCase = tests[i]; + // If security.mixed_content.upgrade_display_content is enabled, the mixed content control mechanism is upgrading file2.jpg + // and HTTPS-Only mode is not failing upgrading file2.jpg, so it won't be logged. + // so skip last test case + if ( + testCase.description == + "Sub-Resource upgrade failure for file_2 should get logged" && + isMCL2Enabled + ) { + tests.splice(i, 1); + continue; + } + // Check if log-level matches + if (logLevel !== testCase.expectLogLevel) { + continue; + } + // Check if all substrings are included + if (testCase.expectIncludes.some(str => !message.includes(str))) { + continue; + } + ok(true, testCase.description); + tests.splice(i, 1); + break; + } + } +} diff --git a/dom/security/test/https-only/browser_continue_button_delay.js b/dom/security/test/https-only/browser_continue_button_delay.js new file mode 100644 index 0000000000..6bdee1610e --- /dev/null +++ b/dom/security/test/https-only/browser_continue_button_delay.js @@ -0,0 +1,59 @@ +"use strict"; + +function waitForEnabledButton() { + return new Promise(resolve => { + const button = content.document.getElementById("openInsecure"); + const observer = new content.MutationObserver(mutations => { + for (const mutation of mutations) { + if ( + mutation.type === "attributes" && + mutation.attributeName === "inert" && + !mutation.target.inert + ) { + resolve(); + } + } + }); + observer.observe(button, { attributeFilter: ["inert"] }); + ok( + button.inert, + "The 'Continue to HTTP Site' button should be inert right after the error page is loaded." + ); + }); +} + +add_task(async function () { + waitForExplicitFinish(); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + const specifiedDelay = Services.prefs.getIntPref( + "security.dialog_enable_delay", + 1000 + ); + + let loaded = BrowserTestUtils.waitForErrorPage(gBrowser.selectedBrowser); + info("Loading insecure page"); + const startTime = Date.now(); + BrowserTestUtils.startLoadingURIString( + gBrowser, + // We specifically want a insecure url here that will fail to upgrade + // eslint-disable-next-line @microsoft/sdl/no-insecure-url + "http://untrusted.example.com:80" + ); + await loaded; + await SpecialPowers.spawn(gBrowser.selectedBrowser, [], waitForEnabledButton); + const endTime = Date.now(); + + const observedDelay = endTime - startTime; + + Assert.greater( + observedDelay, + specifiedDelay - 100, + `The observed delay (${observedDelay}ms) should be roughly the same or greater than the delay specified in "security.dialog_enable_delay" (${specifiedDelay}ms)` + ); + + finish(); +}); diff --git a/dom/security/test/https-only/browser_cors_mixedcontent.js b/dom/security/test/https-only/browser_cors_mixedcontent.js new file mode 100644 index 0000000000..fb78d66979 --- /dev/null +++ b/dom/security/test/https-only/browser_cors_mixedcontent.js @@ -0,0 +1,127 @@ +// Bug 1659505 - Https-Only: CORS and MixedContent tests +// https://bugzilla.mozilla.org/bug/1659505 +"use strict"; + +// > How does this test work? +// We open a page, that makes two fetch-requests to example.com (same-origin) +// and example.org (cross-origin). When both fetch-calls have either failed or +// succeeded, the site dispatches an event with the results. + +add_task(async function () { + // HTTPS-Only Mode disabled + await runTest({ + description: "Load site with HTTP and HOM disabled", + topLevelScheme: "http", + + expectedSameOrigin: "success", // ok + expectedCrossOrigin: "error", // CORS + }); + await runTest({ + description: "Load site with HTTPS and HOM disabled", + topLevelScheme: "https", + + expectedSameOrigin: "error", // Mixed Content + expectedCrossOrigin: "error", // Mixed Content + }); + + // HTTPS-Only Mode disabled and MixedContent blocker disabled + await SpecialPowers.pushPrefEnv({ + set: [["security.mixed_content.block_active_content", false]], + }); + await runTest({ + description: "Load site with HTTPS; HOM and MixedContent blocker disabled", + topLevelScheme: "https", + + expectedSameOrigin: "error", // CORS + expectedCrossOrigin: "error", // CORS + }); + await SpecialPowers.popPrefEnv(); + + // HTTPS-Only Mode enabled, no exception + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + await runTest({ + description: "Load site with HTTP and HOM enabled", + topLevelScheme: "http", + + expectedSameOrigin: "success", // ok + expectedCrossOrigin: "error", // CORS + }); + + // HTTPS-Only enabled, with exception + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "http://example.com", + }, + ]); + + await runTest({ + description: "Load site with HTTP, HOM enabled but site exempt", + topLevelScheme: "http", + + expectedSameOrigin: "success", // ok + expectedCrossOrigin: "error", // CORS + }); + + await SpecialPowers.popPermissions(); + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "https://example.com", + }, + ]); + await runTest({ + description: "Load site with HTTPS, HOM enabled but site exempt", + topLevelScheme: "https", + + expectedSameOrigin: "error", // Mixed Content + expectedCrossOrigin: "error", // Mixed Content + }); + + // Remove permission again (has to be done manually for some reason?) + await SpecialPowers.popPermissions(); +}); + +const SERVER_URL = scheme => + `${scheme}://example.com/browser/dom/security/test/https-only/file_cors_mixedcontent.html`; + +async function runTest(test) { + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + let loaded = BrowserTestUtils.browserLoaded(browser); + + BrowserTestUtils.startLoadingURIString( + browser, + SERVER_URL(test.topLevelScheme) + ); + + await loaded; + + // eslint-disable-next-line no-shadow + await SpecialPowers.spawn(browser, [test], async function (test) { + const promise = new Promise(resolve => { + content.addEventListener("FetchEnded", resolve, { + once: true, + }); + }); + + content.dispatchEvent(new content.Event("StartFetch")); + + const { detail } = await promise; + + is( + detail.comResult, + test.expectedSameOrigin, + `${test.description} (same-origin)` + ); + is( + detail.orgResult, + test.expectedCrossOrigin, + `${test.description} (cross-origin)` + ); + }); + }); +} diff --git a/dom/security/test/https-only/browser_hsts_host.js b/dom/security/test/https-only/browser_hsts_host.js new file mode 100644 index 0000000000..858c19865c --- /dev/null +++ b/dom/security/test/https-only/browser_hsts_host.js @@ -0,0 +1,203 @@ +// Bug 1722489 - HTTPS-Only Mode - Tests evaluation order +// https://bugzilla.mozilla.org/show_bug.cgi?id=1722489 +// This test ensures that an http request to an hsts host +// gets upgraded by hsts and not by https-only. +"use strict"; + +// Set bools to track that tests ended. +let readMessage = false; +let testFinished = false; +// Visit a secure site that sends an HSTS header to set up the rest of the +// test. +add_task(async function see_hsts_header() { + let setHstsUrl = + getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "https://example.com" + ) + "hsts_headers.sjs"; + Services.obs.addObserver(observer, "http-on-examine-response"); + + let promiseLoaded = BrowserTestUtils.browserLoaded( + gBrowser.selectedBrowser, + false, + setHstsUrl + ); + BrowserTestUtils.startLoadingURIString(gBrowser.selectedBrowser, setHstsUrl); + await promiseLoaded; + + await BrowserTestUtils.waitForCondition(() => readMessage); + // Clean up + Services.obs.removeObserver(observer, "http-on-examine-response"); +}); + +// Test that HTTPS_Only is not performed if HSTS host is visited. +add_task(async function () { + // A longer timeout is necessary for this test than the plain mochitests + // due to opening a new tab with the web console. + requestLongerTimeout(4); + + // Enable HTTPS-Only Mode and register console-listener + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + Services.console.registerListener(onNewMessage); + const RESOURCE_LINK = + getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://example.com" + ) + "hsts_headers.sjs"; + + // 1. Upgrade page to https:// + let promiseLoaded = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser); + BrowserTestUtils.startLoadingURIString( + gBrowser.selectedBrowser, + RESOURCE_LINK + ); + await promiseLoaded; + + await BrowserTestUtils.waitForCondition(() => testFinished); + + // Clean up + Services.console.unregisterListener(onNewMessage); + + await SpecialPowers.popPrefEnv(); +}); + +// Test that when clicking on #fragment with a different scheme (http vs https) +// DOES cause an actual navigation with HSTS, even though https-only mode is +// enabled. +add_task(async function () { + await SpecialPowers.pushPrefEnv({ + set: [ + ["dom.security.https_only_mode", true], + [ + "dom.security.https_only_mode_break_upgrade_downgrade_endless_loop", + false, + ], + ], + }); + + const TEST_PAGE = + "http://example.com/browser/dom/security/test/https-only/file_fragment_noscript.html"; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_PAGE, + waitForLoad: true, + }, + async function (browser) { + const UPGRADED_URL = TEST_PAGE.replace("http:", "https:"); + + await SpecialPowers.spawn(browser, [UPGRADED_URL], async function (url) { + is(content.window.location.href, url); + + content.window.addEventListener("scroll", () => { + ok(false, "scroll event should not trigger"); + }); + + let beforeUnload = new Promise(resolve => { + content.window.addEventListener("beforeunload", resolve, { + once: true, + }); + }); + + content.window.document.querySelector("#clickMeButton").click(); + + // Wait for unload event. + await beforeUnload; + }); + + await BrowserTestUtils.browserLoaded(browser); + + await SpecialPowers.spawn(browser, [UPGRADED_URL], async function (url) { + is(content.window.location.href, url + "#foo"); + }); + } + ); + + await SpecialPowers.popPrefEnv(); +}); + +add_task(async function () { + // Reset HSTS header + readMessage = false; + let clearHstsUrl = + getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "https://example.com" + ) + "hsts_headers.sjs?reset"; + + Services.obs.addObserver(observer, "http-on-examine-response"); + // reset hsts header + let promiseLoaded = BrowserTestUtils.browserLoaded( + gBrowser.selectedBrowser, + false, + clearHstsUrl + ); + await BrowserTestUtils.startLoadingURIString( + gBrowser.selectedBrowser, + clearHstsUrl + ); + await promiseLoaded; + await BrowserTestUtils.waitForCondition(() => readMessage); + // Clean up + Services.obs.removeObserver(observer, "http-on-examine-response"); +}); + +function observer(subject, topic, state) { + info("observer called with " + topic); + if (topic == "http-on-examine-response") { + onExamineResponse(subject); + } +} + +function onExamineResponse(subject) { + let channel = subject.QueryInterface(Ci.nsIHttpChannel); + // If message was already read or is not related to "example.com", + // don't examine it. + if (!channel.URI.spec.includes("example.com") || readMessage) { + return; + } + info("onExamineResponse with " + channel.URI.spec); + if (channel.URI.spec.includes("reset")) { + try { + let hsts = channel.getResponseHeader("Strict-Transport-Security"); + is(hsts, "max-age=0", "HSTS header is not set"); + } catch (e) { + ok(false, "HSTS header still set"); + } + readMessage = true; + return; + } + try { + let hsts = channel.getResponseHeader("Strict-Transport-Security"); + let csp = channel.getResponseHeader("Content-Security-Policy"); + // Check that HSTS and CSP upgrade headers are set + is(hsts, "max-age=60", "HSTS header is set"); + is(csp, "upgrade-insecure-requests", "CSP header is set"); + } catch (e) { + ok(false, "No header set"); + } + readMessage = true; +} + +function onNewMessage(msgObj) { + const message = msgObj.message; + // ensure that request is not upgraded HTTPS-Only. + if (message.includes("Upgrading insecure request")) { + ok(false, "Top-Level upgrade shouldn't get logged"); + testFinished = true; + } else if ( + message.includes("Upgrading insecure speculative TCP connection") + ) { + // TODO: Check assertion + // https://bugzilla.mozilla.org/show_bug.cgi?id=1735683 + ok(true, "Top-Level upgrade shouldn't get logged"); + testFinished = true; + } else if (gBrowser.selectedBrowser.currentURI.scheme === "https") { + ok(true, "Top-Level upgrade shouldn't get logged"); + testFinished = true; + } +} diff --git a/dom/security/test/https-only/browser_httpsonly_prefs.js b/dom/security/test/https-only/browser_httpsonly_prefs.js new file mode 100644 index 0000000000..467ab490e7 --- /dev/null +++ b/dom/security/test/https-only/browser_httpsonly_prefs.js @@ -0,0 +1,118 @@ +"use strict"; + +async function runPrefTest( + aHTTPSOnlyPref, + aHTTPSOnlyPrefPBM, + aExecuteFromPBM, + aDesc, + aAssertURLStartsWith +) { + await SpecialPowers.pushPrefEnv({ + set: [ + ["dom.security.https_only_mode", aHTTPSOnlyPref], + ["dom.security.https_only_mode_pbm", aHTTPSOnlyPrefPBM], + ], + }); + + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + await ContentTask.spawn( + browser, + { aExecuteFromPBM, aDesc, aAssertURLStartsWith }, + // eslint-disable-next-line no-shadow + async function ({ aExecuteFromPBM, aDesc, aAssertURLStartsWith }) { + const responseURL = await new Promise(resolve => { + let xhr = new XMLHttpRequest(); + xhr.timeout = 1200; + xhr.open("GET", "http://example.com"); + if (aExecuteFromPBM) { + xhr.channel.loadInfo.originAttributes = { + privateBrowsingId: 1, + }; + } + xhr.onreadystatechange = () => { + // We don't care about the result and it's possible that + // the requests might even succeed in some testing environments + if ( + xhr.readyState !== XMLHttpRequest.OPENED || + xhr.readyState !== XMLHttpRequest.UNSENT + ) { + // Let's make sure this function does not get called anymore + xhr.onreadystatechange = undefined; + resolve(xhr.responseURL); + } + }; + xhr.send(); + }); + ok(responseURL.startsWith(aAssertURLStartsWith), aDesc); + } + ); + }); +} + +add_task(async function () { + requestLongerTimeout(2); + + await runPrefTest( + false, + false, + false, + "Setting no prefs should not upgrade", + "http://" + ); + + await runPrefTest( + true, + false, + false, + "Setting aHTTPSOnlyPref should upgrade", + "https://" + ); + + await runPrefTest( + false, + true, + false, + "Setting aHTTPSOnlyPrefPBM should not upgrade", + "http://" + ); + + await runPrefTest( + false, + false, + true, + "Setting aPBM should not upgrade", + "http://" + ); + + await runPrefTest( + true, + true, + false, + "Setting aHTTPSOnlyPref and aHTTPSOnlyPrefPBM should should upgrade", + "https://" + ); + + await runPrefTest( + true, + false, + true, + "Setting aHTTPSOnlyPref and aPBM should upgrade", + "https://" + ); + + await runPrefTest( + false, + true, + true, + "Setting aHTTPSOnlyPrefPBM and aPBM should upgrade", + "https://" + ); + + await runPrefTest( + true, + true, + true, + "Setting aHTTPSOnlyPref and aHTTPSOnlyPrefPBM and aPBM should upgrade", + "https://" + ); +}); diff --git a/dom/security/test/https-only/browser_httpsonly_speculative_connect.js b/dom/security/test/https-only/browser_httpsonly_speculative_connect.js new file mode 100644 index 0000000000..d48f27b1a9 --- /dev/null +++ b/dom/security/test/https-only/browser_httpsonly_speculative_connect.js @@ -0,0 +1,71 @@ +"use strict"; + +const TEST_PATH_HTTP = getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://example.org" +); + +let console_messages = [ + { + description: "Speculative Connection should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: [ + "Upgrading insecure speculative TCP connection", + "to use", + "example.org", + "file_httpsonly_speculative_connect.html", + ], + }, + { + description: "Upgrade should get logged", + expectLogLevel: Ci.nsIConsoleMessage.warn, + expectIncludes: [ + "Upgrading insecure request", + "to use", + "example.org", + "file_httpsonly_speculative_connect.html", + ], + }, +]; + +function on_new_console_messages(msgObj) { + const message = msgObj.message; + const logLevel = msgObj.logLevel; + + if (message.includes("HTTPS-Only Mode:")) { + for (let i = 0; i < console_messages.length; i++) { + const testCase = console_messages[i]; + // Check if log-level matches + if (logLevel !== testCase.expectLogLevel) { + continue; + } + // Check if all substrings are included + if (testCase.expectIncludes.some(str => !message.includes(str))) { + continue; + } + ok(true, testCase.description); + console_messages.splice(i, 1); + break; + } + } +} + +add_task(async function () { + requestLongerTimeout(4); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + Services.console.registerListener(on_new_console_messages); + + let promiseLoaded = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser); + await BrowserTestUtils.startLoadingURIString( + gBrowser.selectedBrowser, + `${TEST_PATH_HTTP}file_httpsonly_speculative_connect.html` + ); + await promiseLoaded; + + await BrowserTestUtils.waitForCondition(() => console_messages.length === 0); + + Services.console.unregisterListener(on_new_console_messages); +}); diff --git a/dom/security/test/https-only/browser_iframe_test.js b/dom/security/test/https-only/browser_iframe_test.js new file mode 100644 index 0000000000..eb4c1a97c3 --- /dev/null +++ b/dom/security/test/https-only/browser_iframe_test.js @@ -0,0 +1,223 @@ +// Bug 1658264 - Https-Only: HTTPS-Only and iFrames +// https://bugzilla.mozilla.org/show_bug.cgi?id=1658264 +"use strict"; + +// > How does this test work? +// We're sending a request to file_iframe_test.sjs with various +// browser-configurations. The sjs-file returns a website with two iFrames +// loading the same sjs-file again. One iFrame is same origin (example.com) and +// the other cross-origin (example.org) Each request gets saved in a semicolon +// seperated list of strings. The sjs-file gets initialized with the +// query-string "setup" and the result string can be polled with "results". Each +// string has this format: {top/com/org}-{queryString}-{scheme}. In the end +// we're just checking if all expected requests were recorded and had the +// correct scheme. Requests that are meant to fail should explicitly not be +// contained in the list of results. + +// The test loads all tabs and evaluates when all have finished loading +// it may take quite a long time. +// This requires more twice as much as the default 45 seconds per test: +requestLongerTimeout(2); +SimpleTest.requestCompleteLog(); + +add_task(async function () { + await setup(); + + // Using this variable to parallelize and collect tests + let testSet = []; + + /* + * HTTPS-Only Mode disabled + */ + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", false]], + }); + + // Top-Level scheme: HTTP + // NOTE(freddyb): Test case temporarily disabled. See bug 1735565 + /*testSet.push( + runTest({ + queryString: "test1.1", + topLevelScheme: "http", + + expectedTopLevel: "http", + expectedSameOrigin: "http", + expectedCrossOrigin: "http", + }) + );*/ + // Top-Level scheme: HTTPS + testSet.push( + runTest({ + queryString: "test1.2", + topLevelScheme: "https", + + expectedTopLevel: "https", + expectedSameOrigin: "fail", + expectedCrossOrigin: "fail", + }) + ); + + await Promise.all(testSet); + testSet = []; + /* + * HTTPS-Only Mode enabled, no exception + */ + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + // Top-Level scheme: HTTP + testSet.push( + runTest({ + queryString: "test2.1", + topLevelScheme: "http", + + expectedTopLevel: "https", + expectedSameOrigin: "https", + expectedCrossOrigin: "https", + }) + ); + // Top-Level scheme: HTTPS + testSet.push( + runTest({ + queryString: "test2.2", + topLevelScheme: "https", + + expectedTopLevel: "https", + expectedSameOrigin: "https", + expectedCrossOrigin: "https", + }) + ); + + await Promise.all(testSet); + testSet = []; + + /* + * HTTPS-Only enabled, with exceptions + * for http://example.org and http://example.com + */ + // Exempting example.org (cross-site) should not affect anything + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "http://example.org", + }, + ]); + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "http://example.com", + }, + ]); + + // Top-Level scheme: HTTP + await runTest({ + queryString: "test3.1", + topLevelScheme: "http", + + expectedTopLevel: "http", + expectedSameOrigin: "http", + expectedCrossOrigin: "http", + }); + + await SpecialPowers.popPermissions(); + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "https://example.com", + }, + ]); + // Top-Level scheme: HTTPS + await runTest({ + queryString: "test3.2", + topLevelScheme: "https", + + expectedTopLevel: "https", + expectedSameOrigin: "fail", + expectedCrossOrigin: "fail", + }); + + // Remove permissions again (has to be done manually for some reason?) + await SpecialPowers.popPermissions(); + await SpecialPowers.popPermissions(); + + await evaluate(); +}); + +const SERVER_URL = scheme => + `${scheme}://example.com/browser/dom/security/test/https-only/file_iframe_test.sjs?`; +let shouldContain = []; +let shouldNotContain = []; + +async function setup() { + info(`TEST-CASE-setup - A`); + const response = await fetch(SERVER_URL("https") + "setup"); + info(`TEST-CASE-setup - B`); + const txt = await response.text(); + info(`TEST-CASE-setup - C`); + if (txt != "ok") { + ok(false, "Failed to setup test server."); + finish(); + } +} + +async function evaluate() { + info(`TEST-CASE-evaluate - A`); + const response = await fetch(SERVER_URL("https") + "results"); + info(`TEST-CASE-evaluate - B`); + const requestResults = (await response.text()).split(";"); + info(`TEST-CASE-evaluate - C`); + + shouldContain.map(str => + ok(requestResults.includes(str), `Results should contain '${str}'.`) + ); + shouldNotContain.map(str => + ok(!requestResults.includes(str), `Results shouldn't contain '${str}'.`) + ); +} + +async function runTest(test) { + const queryString = test.queryString; + info(`TEST-CASE-${test.queryString} - runTest BEGIN`); + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + let loaded = BrowserTestUtils.browserLoaded( + browser, + false, // includeSubFrames + SERVER_URL(test.expectedTopLevel) + queryString, + false // maybeErrorPage + ); + BrowserTestUtils.startLoadingURIString( + browser, + SERVER_URL(test.topLevelScheme) + queryString + ); + info(`TEST-CASE-${test.queryString} - Before 'await loaded'`); + await loaded; + info(`TEST-CASE-${test.queryString} - After 'await loaded'`); + }); + info(`TEST-CASE-${test.queryString} - After 'await withNewTab'`); + + if (test.expectedTopLevel !== "fail") { + shouldContain.push(`top-${queryString}-${test.expectedTopLevel}`); + } else { + shouldNotContain.push(`top-${queryString}-http`); + shouldNotContain.push(`top-${queryString}-https`); + } + + if (test.expectedSameOrigin !== "fail") { + shouldContain.push(`com-${queryString}-${test.expectedSameOrigin}`); + } else { + shouldNotContain.push(`com-${queryString}-http`); + shouldNotContain.push(`com-${queryString}-https`); + } + + if (test.expectedCrossOrigin !== "fail") { + shouldContain.push(`org-${queryString}-${test.expectedCrossOrigin}`); + } else { + shouldNotContain.push(`org-${queryString}-http`); + shouldNotContain.push(`org-${queryString}-https`); + } + info(`TEST-CASE-${test.queryString} - runTest END`); +} diff --git a/dom/security/test/https-only/browser_navigation.js b/dom/security/test/https-only/browser_navigation.js new file mode 100644 index 0000000000..8c4609a57a --- /dev/null +++ b/dom/security/test/https-only/browser_navigation.js @@ -0,0 +1,94 @@ +"use strict"; + +// For each FIRST_URL_* this test does the following: +// 1. Navigate to FIRST_URL_* +// 2. Check if we are on a HTTPS-Only error page +// 3. Navigate to SECOND_URL +// 4. Navigate back +// 5. Check if we are on a HTTPS-Only error page + +const FIRST_URL_SECURE = "https://example.com"; +const FIRST_URL_INSECURE_REDIRECT = + "http://example.com/browser/dom/security/test/https-only/file_redirect_to_insecure.sjs"; +const FIRST_URL_INSECURE_NOCERT = "http://nocert.example.com"; +const SECOND_URL = "https://example.org"; + +function waitForPage() { + return new Promise(resolve => { + BrowserTestUtils.waitForErrorPage(gBrowser.selectedBrowser).then(resolve); + BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser).then(resolve); + }); +} + +async function verifyErrorPage(expectErrorPage = true) { + await SpecialPowers.spawn( + gBrowser.selectedBrowser, + [expectErrorPage], + async function (_expectErrorPage) { + let doc = content.document; + let innerHTML = doc.body.innerHTML; + let errorPageL10nId = "about-httpsonly-title-alert"; + + is( + innerHTML.includes(errorPageL10nId) && + doc.documentURI.startsWith("about:httpsonlyerror"), + _expectErrorPage, + "we should be on the https-only error page" + ); + } + ); +} + +async function runTest( + firstUrl, + expectErrorPageOnFirstVisit, + expectErrorPageOnSecondVisit +) { + let loaded = waitForPage(); + info("Loading first page"); + BrowserTestUtils.startLoadingURIString(gBrowser, firstUrl); + await loaded; + await verifyErrorPage(expectErrorPageOnFirstVisit); + + loaded = BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser); + info("Navigating to second page"); + await SpecialPowers.spawn( + gBrowser.selectedBrowser, + [SECOND_URL], + async url => (content.location.href = url) + ); + await loaded; + + // Go back one site by clicking the back button + loaded = BrowserTestUtils.waitForLocationChange(gBrowser); + info("Clicking back button"); + let backButton = document.getElementById("back-button"); + backButton.click(); + await loaded; + await verifyErrorPage(expectErrorPageOnSecondVisit); +} + +add_task(async function () { + waitForExplicitFinish(); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + // We don't expect any HTTPS-Only error pages, on the first and second visit of this URL, + // since the URL is reachable via https. + await runTest(FIRST_URL_SECURE, false, false); + + // Since trying to upgrade this url will result in being redirected again to the insecure + // site, we are not able to upgrade it and a HTTPS-Only error page is shown. + // This is happening both on the first and second visit. + await runTest(FIRST_URL_INSECURE_REDIRECT, true, true); + + // Similar to the previous case, we can not upgrade this URL, since this time it has a + // invalid certificate. We would expect a HTTPS-Only error page on both vists, but it is only + // shown on the first one, on the second one we get an errror page about the invalid + // certificate instead (Bug 1848117). + await runTest(FIRST_URL_INSECURE_NOCERT, true, false); + + finish(); +}); diff --git a/dom/security/test/https-only/browser_redirect_tainting.js b/dom/security/test/https-only/browser_redirect_tainting.js new file mode 100644 index 0000000000..0823ec4658 --- /dev/null +++ b/dom/security/test/https-only/browser_redirect_tainting.js @@ -0,0 +1,39 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// Test steps: +// 1. Load file_redirect_tainting.sjs?html. +// 2. The server returns an html which loads an image at http://example.net. +// 3. The image request will be upgraded to HTTPS since HTTPS-only mode is on. +// 4. In file_redirect_tainting.sjs, we set "Access-Control-Allow-Origin" to +// the value of the Origin header. +// 5. If the vlaue does not match, the image won't be loaded. +async function do_test() { + let requestUrl = `https://example.com/browser/dom/security/test/https-only/file_redirect_tainting.sjs?html`; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: requestUrl, + waitForLoad: true, + }, + async function (browser) { + let imageLoaded = await SpecialPowers.spawn(browser, [], function () { + let image = content.document.getElementById("test_image"); + return image && image.complete && image.naturalHeight !== 0; + }); + await Assert.ok(imageLoaded, "test_image should be loaded"); + } + ); +} + +add_task(async function test_https_only_redirect_tainting() { + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + await do_test(); + + await SpecialPowers.popPrefEnv(); +}); diff --git a/dom/security/test/https-only/browser_save_as.js b/dom/security/test/https-only/browser_save_as.js new file mode 100644 index 0000000000..309dd69c79 --- /dev/null +++ b/dom/security/test/https-only/browser_save_as.js @@ -0,0 +1,187 @@ +"use strict"; + +Services.scriptloader.loadSubScript( + "chrome://mochitests/content/browser/toolkit/content/tests/browser/common/mockTransfer.js", + this +); + +// Using insecure HTTP URL for a test cases around HTTP/HTTPS download interaction +// eslint-disable-next-line @microsoft/sdl/no-insecure-url +const HTTP_LINK = `http://example.org/`; +const HTTPS_LINK = `https://example.org/`; +const TEST_PATH = + // eslint-disable-next-line @microsoft/sdl/no-insecure-url + "http://example.com/browser/dom/security/test/https-only/file_save_as.html"; + +let MockFilePicker = SpecialPowers.MockFilePicker; +MockFilePicker.init(window); +const tempDir = createTemporarySaveDirectory(); +MockFilePicker.displayDirectory = tempDir; + +add_setup(async function () { + info("Setting MockFilePicker."); + mockTransferRegisterer.register(); + + registerCleanupFunction(function () { + mockTransferRegisterer.unregister(); + MockFilePicker.cleanup(); + tempDir.remove(true); + }); +}); + +function createTemporarySaveDirectory() { + let saveDir = Services.dirsvc.get("TmpD", Ci.nsIFile); + saveDir.append("testsavedir"); + saveDir.createUnique(Ci.nsIFile.DIRECTORY_TYPE, 0o755); + return saveDir; +} + +function createPromiseForObservingChannel(expectedUrl) { + return new Promise(resolve => { + let observer = (aSubject, aTopic) => { + if (aTopic === "http-on-modify-request") { + let httpChannel = aSubject.QueryInterface(Ci.nsIHttpChannel); + + if (httpChannel.URI.spec != expectedUrl) { + return; + } + + Services.obs.removeObserver(observer, "http-on-modify-request"); + resolve(); + } + }; + + Services.obs.addObserver(observer, "http-on-modify-request"); + }); +} + +function createPromiseForTransferComplete() { + return new Promise(resolve => { + MockFilePicker.showCallback = fp => { + info("MockFilePicker showCallback"); + + let fileName = fp.defaultString; + let destFile = tempDir.clone(); + destFile.append(fileName); + + MockFilePicker.setFiles([destFile]); + MockFilePicker.filterIndex = 0; // kSaveAsType_Complete + + MockFilePicker.showCallback = null; + mockTransferCallback = function (downloadSuccess) { + ok(downloadSuccess, "File should have been downloaded successfully"); + mockTransferCallback = () => {}; + resolve(); + }; + }; + }); +} + +function createPromiseForConsoleError(message) { + return new Promise((resolve, reject) => { + function listener(msgObj) { + let text = msgObj.message; + if (text.includes(message)) { + info(`Found occurence of '${message}'`); + Services.console.unregisterListener(listener); + resolve(); + } + } + Services.console.registerListener(listener); + }); +} + +async function runTest(selector, expectedUrl, expectedError) { + info(`Open a new tab for testing "Save link as" in context menu.`); + let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_PATH); + + let popupShownPromise = BrowserTestUtils.waitForEvent(document, "popupshown"); + + let browser = gBrowser.selectedBrowser; + + info("Open the context menu."); + await BrowserTestUtils.synthesizeMouseAtCenter( + selector, + { + type: "contextmenu", + button: 2, + }, + browser + ); + + await popupShownPromise; + + let downloadEndPromise = expectedError + ? createPromiseForConsoleError(expectedError) + : createPromiseForTransferComplete(); + let observerPromise = createPromiseForObservingChannel(expectedUrl); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + let popupHiddenPromise = BrowserTestUtils.waitForEvent( + contextMenu, + "popuphidden" + ); + + // Select "Save As" option from context menu. + let saveElement = document.getElementById(`context-savelink`); + info("Triggering the save process."); + contextMenu.activateItem(saveElement); + + info("Waiting for the channel."); + await observerPromise; + + info( + expectedError + ? "Waiting for error in console." + : "Wait until the save is finished." + ); + await downloadEndPromise; + + info("Wait until the menu is closed."); + await popupHiddenPromise; + + BrowserTestUtils.removeTab(tab); +} + +async function setHttpsFirstAndOnlyPrefs(httpsFirst, httpsOnly) { + await SpecialPowers.pushPrefEnv({ + set: [ + ["dom.security.https_first", httpsFirst], + ["dom.security.https_only_mode", httpsOnly], + ], + }); +} + +add_task(async function testBaseline() { + // Run with HTTPS-First and HTTPS-Only disabled + await setHttpsFirstAndOnlyPrefs(false, false); + await runTest("#insecure-link", HTTP_LINK, undefined); + await runTest("#secure-link", HTTPS_LINK, undefined); +}); + +add_task(async function testHttpsFirst() { + // Run with HTTPS-First enabled + // The the user will get a warning about really wanting to download + // from a insecure site, because we upgraded the top level document, + // but the download is still insecure. In the future we also want to + // upgrade these Save-As downloads. + await setHttpsFirstAndOnlyPrefs(true, false); + await runTest( + "#insecure-link", + HTTP_LINK, + "Blocked downloading insecure content “http://example.org/”." + ); + await runTest("#secure-link", HTTPS_LINK, undefined); +}); + +add_task(async function testHttpsOnly() { + // Run with HTTPS-Only enabled + // Should have same behaviour as HTTPS-First + await setHttpsFirstAndOnlyPrefs(false, true); + await runTest( + "#insecure-link", + HTTP_LINK, + "Blocked downloading insecure content “http://example.org/”." + ); + await runTest("#secure-link", HTTPS_LINK, undefined); +}); diff --git a/dom/security/test/https-only/browser_triggering_principal_exemption.js b/dom/security/test/https-only/browser_triggering_principal_exemption.js new file mode 100644 index 0000000000..09a867a63b --- /dev/null +++ b/dom/security/test/https-only/browser_triggering_principal_exemption.js @@ -0,0 +1,72 @@ +// Bug 1662359 - Don't upgrade subresources whose triggering principal is exempt from HTTPS-Only mode. +// https://bugzilla.mozilla.org/bug/1662359 +"use strict"; + +const TRIGGERING_PAGE = "http://example.org"; +const LOADED_RESOURCE = "http://example.com"; + +add_task(async function () { + // Enable HTTPS-Only Mode + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + await runTest( + "Request with not exempt triggering principal should get upgraded.", + "https://" + ); + + // Now exempt the triggering page + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: TRIGGERING_PAGE, + }, + ]); + + await runTest( + "Request with exempt triggering principal should not get upgraded.", + "http://" + ); + + await SpecialPowers.popPermissions(); +}); + +async function runTest(desc, startsWith) { + const responseURL = await new Promise(resolve => { + let xhr = new XMLHttpRequest(); + xhr.open("GET", LOADED_RESOURCE); + + // Replace loadinfo with one whose triggeringPrincipal is a content + // principal for TRIGGERING_PAGE. + const triggeringPrincipal = + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + TRIGGERING_PAGE + ); + let dummyURI = Services.io.newURI(LOADED_RESOURCE); + let dummyChannel = NetUtil.newChannel({ + uri: dummyURI, + triggeringPrincipal, + loadingPrincipal: xhr.channel.loadInfo.loadingPrincipal, + securityFlags: xhr.channel.loadInfo.securityFlags, + contentPolicyType: xhr.channel.loadInfo.externalContentPolicyType, + }); + xhr.channel.loadInfo = dummyChannel.loadInfo; + + xhr.onreadystatechange = () => { + // We don't care about the result, just if Firefox upgraded the URL + // internally. + if ( + xhr.readyState !== XMLHttpRequest.OPENED || + xhr.readyState !== XMLHttpRequest.UNSENT + ) { + // Let's make sure this function doesn't get called anymore + xhr.onreadystatechange = undefined; + resolve(xhr.responseURL); + } + }; + xhr.send(); + }); + ok(responseURL.startsWith(startsWith), desc); +} diff --git a/dom/security/test/https-only/browser_upgrade_exceptions.js b/dom/security/test/https-only/browser_upgrade_exceptions.js new file mode 100644 index 0000000000..8611b32a0f --- /dev/null +++ b/dom/security/test/https-only/browser_upgrade_exceptions.js @@ -0,0 +1,86 @@ +// Bug 1625448 - HTTPS Only Mode - Exceptions for loopback and local IP addresses +// https://bugzilla.mozilla.org/show_bug.cgi?id=1631384 +// This test ensures that various configurable upgrade exceptions work +"use strict"; + +add_task(async function () { + requestLongerTimeout(2); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + // Loopback test + await runTest( + "Loopback IP addresses should always be exempt from upgrades (localhost)", + "http://localhost", + "http://" + ); + await runTest( + "Loopback IP addresses should always be exempt from upgrades (127.0.0.1)", + "http://127.0.0.1", + "http://" + ); + // Default local-IP and onion tests + await runTest( + "Local IP addresses should be exempt from upgrades by default", + "http://10.0.250.250", + "http://" + ); + await runTest( + "Hosts ending with .onion should be be exempt from HTTPS-Only upgrades by default", + "http://grocery.shopping.for.one.onion", + "http://" + ); + + await SpecialPowers.pushPrefEnv({ + set: [ + ["dom.security.https_only_mode.upgrade_local", true], + ["dom.security.https_only_mode.upgrade_onion", true], + ], + }); + + // Local-IP and onion tests with upgrade enabled + await runTest( + "Local IP addresses should get upgraded when 'dom.security.https_only_mode.upgrade_local' is set to true", + "http://10.0.250.250", + "https://" + ); + await runTest( + "Hosts ending with .onion should get upgraded when 'dom.security.https_only_mode.upgrade_onion' is set to true", + "http://grocery.shopping.for.one.onion", + "https://" + ); + // Local-IP request with HTTPS_ONLY_EXEMPT flag + await runTest( + "The HTTPS_ONLY_EXEMPT flag should overrule upgrade-prefs", + "http://10.0.250.250", + "http://", + true + ); +}); + +async function runTest(desc, url, startsWith, exempt = false) { + const responseURL = await new Promise(resolve => { + let xhr = new XMLHttpRequest(); + xhr.timeout = 1200; + xhr.open("GET", url); + if (exempt) { + xhr.channel.loadInfo.httpsOnlyStatus |= Ci.nsILoadInfo.HTTPS_ONLY_EXEMPT; + } + xhr.onreadystatechange = () => { + // We don't care about the result and it's possible that + // the requests might even succeed in some testing environments + if ( + xhr.readyState !== XMLHttpRequest.OPENED || + xhr.readyState !== XMLHttpRequest.UNSENT + ) { + // Let's make sure this function doesn't get caled anymore + xhr.onreadystatechange = undefined; + resolve(xhr.responseURL); + } + }; + xhr.send(); + }); + ok(responseURL.startsWith(startsWith), desc); +} diff --git a/dom/security/test/https-only/browser_upgrade_exemption.js b/dom/security/test/https-only/browser_upgrade_exemption.js new file mode 100644 index 0000000000..23d857b511 --- /dev/null +++ b/dom/security/test/https-only/browser_upgrade_exemption.js @@ -0,0 +1,80 @@ +"use strict"; + +const PAGE_WITHOUT_SCHEME = "://example.com"; + +add_task(async function () { + // Load a insecure page with HTTPS-Only and HTTPS-First disabled + await runTest({ + loadScheme: "http", + expectScheme: "http", + }); + + // Load a secure page with HTTPS-Only and HTTPS-First disabled + await runTest({ + loadScheme: "https", + expectScheme: "https", + }); + + // Load a exempted insecure page with HTTPS-Only and HTTPS-First disabled + await runTest({ + exempt: true, + loadScheme: "http", + expectScheme: "http", + }); + + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + // Load a insecure page with HTTPS-Only enabled + await runTest({ + loadScheme: "http", + expectScheme: "https", + }); + + // Load a exempted insecure page with HTTPS-Only enabled + await runTest({ + exempt: true, + loadScheme: "http", + expectScheme: "http", + }); + + await SpecialPowers.flushPrefEnv(); + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_first", true]], + }); + + // Load a insecure page with HTTPS-First enabled + await runTest({ + loadScheme: "http", + expectScheme: "https", + }); + + // Load a exempted insecure page with HTTPS-First enabled + await runTest({ + exempt: true, + loadScheme: "http", + expectScheme: "http", + }); +}); + +async function runTest(options) { + const { exempt = false, loadScheme, expectScheme } = options; + const page = loadScheme + PAGE_WITHOUT_SCHEME; + + if (exempt) { + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: page, + }, + ]); + } + + await BrowserTestUtils.withNewTab(page, async function (browser) { + is(browser.currentURI.scheme, expectScheme, "Unexpected scheme"); + await SpecialPowers.popPermissions(); + await SpecialPowers.popPrefEnv(); + }); +} diff --git a/dom/security/test/https-only/browser_user_gesture.js b/dom/security/test/https-only/browser_user_gesture.js new file mode 100644 index 0000000000..e7d6a20318 --- /dev/null +++ b/dom/security/test/https-only/browser_user_gesture.js @@ -0,0 +1,55 @@ +// Bug 1725026 - HTTPS Only Mode - Test if a load triggered by a user gesture +// https://bugzilla.mozilla.org/show_bug.cgi?id=1725026 +// Test if a load triggered by a user gesture can be upgraded to HTTPS +// successfully. + +"use strict"; + +const testPathUpgradeable = getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://example.com" +); + +const kTestURI = testPathUpgradeable + "file_user_gesture.html"; + +add_task(async function () { + // Enable HTTPS-Only Mode and register console-listener + await SpecialPowers.pushPrefEnv({ + set: [["dom.security.https_only_mode", true]], + }); + + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + const loaded = BrowserTestUtils.browserLoaded(browser, false, null, true); + // 1. Upgrade a page to https:// + BrowserTestUtils.startLoadingURIString(browser, kTestURI); + await loaded; + await ContentTask.spawn(browser, {}, async args => { + ok( + content.document.location.href.startsWith("https://"), + "Should be https" + ); + + // 2. Trigger a load by clicking button. + // The scheme of the link url is `http` and the load should be able to + // upgraded to `https` because of HTTPS-only mode. + let button = content.document.getElementById("httpLinkButton"); + await EventUtils.synthesizeMouseAtCenter( + button, + { type: "mousedown" }, + content + ); + await EventUtils.synthesizeMouseAtCenter( + button, + { type: "mouseup" }, + content + ); + await ContentTaskUtils.waitForCondition(() => { + return content.document.location.href.startsWith("https://"); + }); + ok( + content.document.location.href.startsWith("https://"), + "Should be https" + ); + }); + }); +}); diff --git a/dom/security/test/https-only/browser_websocket_exceptions.js b/dom/security/test/https-only/browser_websocket_exceptions.js new file mode 100644 index 0000000000..a6e5336c63 --- /dev/null +++ b/dom/security/test/https-only/browser_websocket_exceptions.js @@ -0,0 +1,68 @@ +"use strict"; + +const TEST_PATH_HTTP = getRootDirectory(gTestPath).replace( + "chrome://mochitests/content", + "http://localhost:9898" +); + +let WEBSOCKET_DOC_URL = `${TEST_PATH_HTTP}file_websocket_exceptions.html`; + +add_task(async function () { + // Here is a sequence of how this test works: + // 1. Dynamically inject a localhost iframe + // 2. Add an exemption for localhost + // 3. Fire up Websocket + // Generally local IP addresses are exempt from https-only, but if we do not add + // an exemption for localhost, then the TriggeringPrincipal of the WebSocket is + // `not` exempt and we would upgrade ws to wss. + + await SpecialPowers.pushPrefEnv({ + set: [ + ["dom.security.https_only_mode", true], + ["network.proxy.allow_hijacking_localhost", true], + ], + }); + + await BrowserTestUtils.withNewTab("about:blank", async function (browser) { + let loaded = BrowserTestUtils.browserLoaded(browser); + + BrowserTestUtils.startLoadingURIString(browser, WEBSOCKET_DOC_URL); + await loaded; + + await SpecialPowers.spawn(browser, [], async function () { + // Part 1: + let myIframe = content.document.createElement("iframe"); + content.document.body.appendChild(myIframe); + myIframe.src = + "http://localhost:9898/browser/dom/security/test/https-only/file_websocket_exceptions_iframe.html"; + + myIframe.onload = async function () { + // Part 2: + await SpecialPowers.pushPermissions([ + { + type: "https-only-load-insecure", + allow: true, + context: "http://localhost:9898", + }, + ]); + // Part 3. + myIframe.contentWindow.postMessage({ myMessage: "runWebSocket" }, "*"); + }; + + const promise = new Promise(resolve => { + content.addEventListener("WebSocketEnded", resolve, { + once: true, + }); + }); + + const { detail } = await promise; + + is(detail.state, "onopen", "sanity: websocket loaded"); + ok( + detail.url.startsWith("ws://example.com/tests"), + "exempt websocket should not be upgraded to wss://" + ); + }); + }); + await SpecialPowers.popPermissions(); +}); diff --git a/dom/security/test/https-only/file_background_redirect.sjs b/dom/security/test/https-only/file_background_redirect.sjs new file mode 100644 index 0000000000..45e01797e3 --- /dev/null +++ b/dom/security/test/https-only/file_background_redirect.sjs @@ -0,0 +1,32 @@ +// Custom *.sjs file specifically for the needs of Bug 1683015 +"use strict"; + +let { setTimeout } = ChromeUtils.importESModule( + "resource://gre/modules/Timer.sys.mjs" +); + +async function handleRequest(request, response) { + // avoid confusing cache behaviour + response.setHeader("Cache-Control", "no-cache", false); + response.setHeader("Content-Type", "text/html", false); + + let query = request.queryString; + if (request.scheme === "https" && query === "start") { + // Simulating long repsonse time by processing the https request + // using a 5 seconds delay. Note that the http background request + // gets send after 3 seconds + response.processAsync(); + setTimeout(() => { + response.setStatusLine("1.1", 200, "OK"); + response.write( + "<html><body>Test Page for Bug 1683015 loaded</body></html>" + ); + response.finish(); + }, 5000); /* wait 5 seconds */ + return; + } + + // we should never get here, but just in case return something unexpected + response.setStatusLine("1.1", 404, "Not Found"); + response.write("<html><body>SHOULDN'T DISPLAY THIS PAGE</body></html>"); +} diff --git a/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs b/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs new file mode 100644 index 0000000000..a8a9083ef3 --- /dev/null +++ b/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs @@ -0,0 +1,67 @@ +// Custom *.sjs file specifically for the needs of Bug 1691888 +"use strict"; + +const REDIRECT_META = ` + <html> + <head> + <meta http-equiv="refresh" content="0; url='http://example.com/tests/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs?test1b'"> + </head> + <body> + META REDIRECT + </body> + </html>`; + +const REDIRECT_JS = ` + <html> + <body> + JS REDIRECT + <script> + let url= "http://example.com/tests/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs?test2b"; + window.location = url; + </script> + </body> + </html>`; + +const REDIRECT_302 = + "http://example.com/tests/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs?test3b"; + +const REDIRECT_302_DIFFERENT_PATH = + "http://example.com/tests/dom/security/test/https-only/file_user_gesture.html"; + +function handleRequest(request, response) { + // avoid confusing cache behaviour + response.setHeader("Cache-Control", "no-cache", false); + response.setHeader("Content-Type", "text/html", false); + + // if the scheme is not https, meaning that the initial request did not + // get upgraded, then we rather fall through and display unexpected content. + if (request.scheme === "https") { + let query = request.queryString; + + if (query === "test1a") { + response.write(REDIRECT_META); + return; + } + + if (query === "test2a") { + response.write(REDIRECT_JS); + return; + } + + if (query === "test3a") { + response.setStatusLine("1.1", 302, "Found"); + response.setHeader("Location", REDIRECT_302, false); + return; + } + + if (query === "test4a") { + response.setStatusLine("1.1", 302, "Found"); + response.setHeader("Location", REDIRECT_302_DIFFERENT_PATH, false); + return; + } + } + + // we should never get here, just in case, + // let's return something unexpected + response.write("<html><body>DO NOT DISPLAY THIS</body></html>"); +} diff --git a/dom/security/test/https-only/file_bug1874801.html b/dom/security/test/https-only/file_bug1874801.html new file mode 100644 index 0000000000..58c2f03c81 --- /dev/null +++ b/dom/security/test/https-only/file_bug1874801.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html lang="en"> +<head> + <meta charset="UTF-8"> + <meta name="viewport" content="width=device-width, initial-scale=1.0"> + <title>Bug 1874801</title> +</head> +<body> + <img src="http://example.com/browser/dom/security/test/https-only/file_bug1874801.sjs"> +</body> +</html> diff --git a/dom/security/test/https-only/file_bug1874801.sjs b/dom/security/test/https-only/file_bug1874801.sjs new file mode 100644 index 0000000000..ce84af1d5f --- /dev/null +++ b/dom/security/test/https-only/file_bug1874801.sjs @@ -0,0 +1,17 @@ +/* Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ */ + +function handleRequest(request, response) { + response.setHeader("Cache-Control", "no-cache", false); + if (request.scheme === "https") { + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "image/svg+xml"); + response.write( + `<svg version="1.1" width="100" height="40" xmlns="http://www.w3.org/2000/svg"><text x="20" y="20">HTTPS</text></svg>` + ); + return; + } + if (request.scheme === "http") { + response.setStatusLine(request.httpVersion, 400, "Bad Request"); + } +} diff --git a/dom/security/test/https-only/file_console_logging.html b/dom/security/test/https-only/file_console_logging.html new file mode 100644 index 0000000000..94e07cddd9 --- /dev/null +++ b/dom/security/test/https-only/file_console_logging.html @@ -0,0 +1,16 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Bug 1625448 - HTTPS Only Mode - Tests for console logging</title> +</head> +<body> + <!-- These files don't exist since we only care if the webserver can respond. --> + <!-- This request can get upgraded. --> + <img src="http://example.com/file_1.jpg"> + <!-- This request can't get upgraded --> + <img src="http://self-signed.example.com/file_2.jpg"> + + <iframe src="http://self-signed.example.com/browser/dom/security/test/https-only/file_console_logging.html"></iframe> +</body> +</html> diff --git a/dom/security/test/https-only/file_cors_mixedcontent.html b/dom/security/test/https-only/file_cors_mixedcontent.html new file mode 100644 index 0000000000..50d32954ef --- /dev/null +++ b/dom/security/test/https-only/file_cors_mixedcontent.html @@ -0,0 +1,42 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + + <script> + addEventListener("StartFetch", async function() { + let comResult; + let orgResult; + + await Promise.all([ + fetch("http://example.com/") + .then(() => { + comResult = "success"; + }) + .catch(() => { + comResult = "error"; + }), + fetch("http://example.org/") + .then(() => { + orgResult = "success"; + }) + .catch(() => { + orgResult = "error"; + }), + ]); + + window.dispatchEvent(new CustomEvent("FetchEnded", { + detail: { comResult, orgResult } + })); + + }) + </script> +</head> + +<body> + <h2>Https-Only: CORS and MixedContent tests</h2> + <p><a href="https://bugzilla.mozilla.org/bug/1659505">Bug 1659505</a></p> +</body> + +</html> diff --git a/dom/security/test/https-only/file_fragment.html b/dom/security/test/https-only/file_fragment.html new file mode 100644 index 0000000000..49cff76f9a --- /dev/null +++ b/dom/security/test/https-only/file_fragment.html @@ -0,0 +1,47 @@ +<!DOCTYPE HTML> +<html> +<script> +// sends url of current window and onbeforeunloadMessage +// when we enter here test failed. +function beforeunload(){ + window.opener.postMessage({ + info: "before-unload", + result: window.location.hash, + button: false, + }, "*"); +} + +// sends url of current window and then click on button +window.onload = function (){ + // get button by ID + let button = window.document.getElementById("clickMeButton"); + // if getting button was successful, buttonExist = true + let buttonExist = button !== null; + // send loading message + window.opener.postMessage({ + info: "onload", + result: window.location.href, + button: buttonExist, + }, "*"); + // click button + button.click(); +} +// after button clicked and paged scrolled sends URL of current window +window.onscroll = function(){ + window.opener.postMessage({ + info: "scrolled-to-foo", + result: window.location.href, + button: true, + documentURI: document.documentURI, + }, "*"); + } + + +</script> +<body onbeforeunload="/*just to notify if we load a new page*/ beforeunload()";> + <a id="clickMeButton" href="http://example.com/tests/dom/security/test/https-only/file_fragment.html#foo">Click me</a> + <div style="height: 1000px; border: 1px solid black;"> space</div> + <a name="foo" href="http://example.com/tests/dom/security/test/https-only/file_fragment.html">foo</a> + <div style="height: 1000px; border: 1px solid black;">space</div> +</body> +</html> diff --git a/dom/security/test/https-only/file_fragment_noscript.html b/dom/security/test/https-only/file_fragment_noscript.html new file mode 100644 index 0000000000..609961fd98 --- /dev/null +++ b/dom/security/test/https-only/file_fragment_noscript.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<body> + <a id="clickMeButton" href="http://example.com/browser/dom/security/test/https-only/file_fragment_noscript.html#foo">Click me</a> + <div style="height: 1000px; border: 1px solid black;"> space</div> + <a name="foo" href="http://example.com/browser/dom/security/test/https-only/file_fragment_noscript.html">foo</a> + <div style="height: 1000px; border: 1px solid black;">space</div> +</body> +</html> diff --git a/dom/security/test/https-only/file_http_background_auth_request.sjs b/dom/security/test/https-only/file_http_background_auth_request.sjs new file mode 100644 index 0000000000..80fc8ffcf7 --- /dev/null +++ b/dom/security/test/https-only/file_http_background_auth_request.sjs @@ -0,0 +1,16 @@ +// Custom *.sjs file specifically for the needs of Bug 1665062 + +function handleRequest(request, response) { + // avoid confusing cache behaviors + response.setHeader("Cache-Control", "no-cache", false); + + if (request.scheme === "https") { + response.setHeader("Content-Type", "text/html;charset=utf-8", false); + response.setStatusLine(request.httpVersion, 401, "Unauthorized"); + response.setHeader("WWW-Authenticate", 'Basic realm="bug1665062"'); + return; + } + + // we should never get here; just in case, return something unexpected + response.write("do'h"); +} diff --git a/dom/security/test/https-only/file_http_background_request.sjs b/dom/security/test/https-only/file_http_background_request.sjs new file mode 100644 index 0000000000..ef0e2ce5bd --- /dev/null +++ b/dom/security/test/https-only/file_http_background_request.sjs @@ -0,0 +1,15 @@ +// Custom *.sjs file specifically for the needs of Bug 1663396 + +function handleRequest(request, response) { + // avoid confusing cache behaviors + response.setHeader("Cache-Control", "no-cache", false); + + if (request.scheme === "https") { + // Simulating a timeout by processing the https request + // async and *never* return anything! + response.processAsync(); + return; + } + // we should never get here; just in case, return something unexpected + response.write("do'h"); +} diff --git a/dom/security/test/https-only/file_httpsonly_speculative_connect.html b/dom/security/test/https-only/file_httpsonly_speculative_connect.html new file mode 100644 index 0000000000..46a10401f9 --- /dev/null +++ b/dom/security/test/https-only/file_httpsonly_speculative_connect.html @@ -0,0 +1 @@ +<html><body>dummy file for speculative https-only upgrade test</body></html> diff --git a/dom/security/test/https-only/file_iframe_test.sjs b/dom/security/test/https-only/file_iframe_test.sjs new file mode 100644 index 0000000000..611870c87c --- /dev/null +++ b/dom/security/test/https-only/file_iframe_test.sjs @@ -0,0 +1,58 @@ +// Bug 1658264 - HTTPS-Only and iFrames +// see browser_iframe_test.js + +const IFRAME_CONTENT = ` +<!DOCTYPE HTML> +<html> + <head><meta charset="utf-8"></head> + <body>Helo Friend!</body> +</html>`; +const DOCUMENT_CONTENT = q => ` +<!DOCTYPE HTML> +<html> + <head><meta charset="utf-8"></head> + <body> + <iframe src="http://example.com/browser/dom/security/test/https-only/file_iframe_test.sjs?com-${q}"></iframe> + <iframe src="http://example.org/browser/dom/security/test/https-only/file_iframe_test.sjs?org-${q}"></iframe> + </body> +</html>`; + +function handleRequest(request, response) { + // avoid confusing cache behaviors + response.setHeader("Cache-Control", "no-cache", false); + let queryString = request.queryString; + const queryScheme = request.scheme; + + // Setup the state with an empty string and return "ok" + if (queryString == "setup") { + setState("receivedQueries", ""); + response.write("ok"); + return; + } + + let receivedQueries = getState("receivedQueries"); + + // Return result-string + if (queryString == "results") { + response.write(receivedQueries); + return; + } + + // Add semicolon to seperate strings + if (receivedQueries !== "") { + receivedQueries += ";"; + } + + // Requests from iFrames start with com or org + if (queryString.startsWith("com-") || queryString.startsWith("org-")) { + receivedQueries += queryString; + setState("receivedQueries", `${receivedQueries}-${queryScheme}`); + response.write(IFRAME_CONTENT); + return; + } + + // Everything else has to be a top-level request + receivedQueries += `top-${queryString}`; + setState("receivedQueries", `${receivedQueries}-${queryScheme}`); + response.write(DOCUMENT_CONTENT(queryString)); +} diff --git a/dom/security/test/https-only/file_insecure_reload.sjs b/dom/security/test/https-only/file_insecure_reload.sjs new file mode 100644 index 0000000000..a48ec4e20f --- /dev/null +++ b/dom/security/test/https-only/file_insecure_reload.sjs @@ -0,0 +1,27 @@ +// https://bugzilla.mozilla.org/show_bug.cgi?id=1702001 + +// An onload postmessage to window opener +const ON_LOAD = ` + <html> + <body> + send onload message... + <script type="application/javascript"> + window.opener.postMessage({result: 'you entered the http page', historyLength: history.length}, '*'); + </script> + </body> + </html>`; + +// When an https request is sent, cause a timeout so that the https-only error +// page is displayed. +function handleRequest(request, response) { + response.setHeader("Cache-Control", "no-cache", false); + if (request.scheme === "https") { + // Simulating a timeout by processing the https request + // async and *never* return anything! + response.processAsync(); + return; + } + if (request.scheme === "http") { + response.write(ON_LOAD); + } +} diff --git a/dom/security/test/https-only/file_redirect.sjs b/dom/security/test/https-only/file_redirect.sjs new file mode 100644 index 0000000000..c66cbaa226 --- /dev/null +++ b/dom/security/test/https-only/file_redirect.sjs @@ -0,0 +1,37 @@ +// https://bugzilla.mozilla.org/show_bug.cgi?id=1613063 + +// Step 1. Send request with redirect queryString (eg. file_redirect.sjs?302) +// Step 2. Server responds with corresponding redirect code to http://example.com/../file_redirect.sjs?check +// Step 3. Response from ?check indicates whether the redirected request was secure or not. + +const RESPONSE_SECURE = "secure-ok"; +const RESPONSE_INSECURE = "secure-error"; +const RESPONSE_ERROR = "unexpected-query"; + +function handleRequest(request, response) { + response.setHeader("Cache-Control", "no-cache", false); + + const query = request.queryString; + + // Send redirect header + if ((query >= 301 && query <= 303) || query == 307) { + const loc = + "http://example.com/tests/dom/security/test/https-only/file_redirect.sjs?check"; + response.setStatusLine(request.httpVersion, query, "Moved"); + response.setHeader("Location", loc, false); + return; + } + + // Check if scheme is http:// oder https:// + if (query == "check") { + const secure = + request.scheme == "https" ? RESPONSE_SECURE : RESPONSE_INSECURE; + response.setStatusLine(request.httpVersion, 200, "OK"); + response.write(secure); + return; + } + + // This should not happen + response.setStatusLine(request.httpVersion, 500, "OK"); + response.write(RESPONSE_ERROR); +} diff --git a/dom/security/test/https-only/file_redirect_tainting.sjs b/dom/security/test/https-only/file_redirect_tainting.sjs new file mode 100644 index 0000000000..9ecca88d6d --- /dev/null +++ b/dom/security/test/https-only/file_redirect_tainting.sjs @@ -0,0 +1,39 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// small red image +const IMG_BYTES = atob( + "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" + + "P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" +); + +const body = `<!DOCTYPE html> +<html lang="en"> + <body> + <script> + let image = new Image(); + image.crossOrigin = "anonymous"; + image.src = "http://example.net/browser/dom/security/test/https-only/file_redirect_tainting.sjs?img"; + image.id = "test_image"; + document.body.appendChild(image); + </script> + </body> +</html>`; + +function handleRequest(request, response) { + if (request.queryString === "html") { + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "text/html"); + response.write(body); + return; + } + + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "image/png"); + let origin = request.getHeader("Origin"); + response.setHeader("Access-Control-Allow-Origin", origin); + response.write(IMG_BYTES); +} diff --git a/dom/security/test/https-only/file_redirect_to_insecure.sjs b/dom/security/test/https-only/file_redirect_to_insecure.sjs new file mode 100644 index 0000000000..ea88223926 --- /dev/null +++ b/dom/security/test/https-only/file_redirect_to_insecure.sjs @@ -0,0 +1,16 @@ +// Redirect back to http if visited via https. This way we can simulate +// a site which can not be upgraded by HTTPS-Only. + +function handleRequest(request, response) { + response.setHeader("Cache-Control", "no-cache", false); + if (request.scheme === "https") { + response.setStatusLine(request.httpVersion, "302", "Found"); + response.setHeader( + "Location", + // We explicitly want a insecure URL here, so disable eslint + // eslint-disable-next-line @microsoft/sdl/no-insecure-url + `http://${request.host}${request.path}`, + false + ); + } +} diff --git a/dom/security/test/https-only/file_save_as.html b/dom/security/test/https-only/file_save_as.html new file mode 100644 index 0000000000..44232b16ec --- /dev/null +++ b/dom/security/test/https-only/file_save_as.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="UTF-8"> +</head> +<body> + <a href="http://example.org" id="insecure-link">Insecure Link</a> + <a href="https://example.org" id="secure-link">Secure Link</a> +</body> +</html>
\ No newline at end of file diff --git a/dom/security/test/https-only/file_upgrade_insecure.html b/dom/security/test/https-only/file_upgrade_insecure.html new file mode 100644 index 0000000000..346cfbeb9c --- /dev/null +++ b/dom/security/test/https-only/file_upgrade_insecure.html @@ -0,0 +1,91 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Bug 1613063 - HTTPS Only Mode</title> + <!-- style --> + <link rel='stylesheet' type='text/css' href='http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?style' media='screen' /> + + <!-- font --> + <style> + @font-face { + font-family: "foofont"; + src: url('http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?font'); + } + .div_foo { font-family: "foofont"; } + </style> +</head> +<body> + + <!-- images: --> + <img src="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?img"></img> + + <!-- redirects: upgrade http:// to https:// redirect to http:// and then upgrade to https:// again --> + <img src="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?redirect-image"></img> + + <!-- script: --> + <script src="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?script"></script> + + <!-- media: --> + <audio src="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?media"></audio> + + <!-- objects: --> + <object width="10" height="10" data="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?object"></object> + + <!-- font: (apply font loaded in header to div) --> + <div class="div_foo">foo</div> + + <!-- iframe: (same origin) --> + <iframe src="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?iframe"> + <!-- within that iframe we load an image over http and make sure the requested gets upgraded to https --> + </iframe> + + <!-- xhr: --> + <script type="application/javascript"> + var myXHR = new XMLHttpRequest(); + myXHR.open("GET", "http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?xhr"); + myXHR.send(null); + </script> + + <!-- websockets: upgrade ws:// to wss://--> + <script type="application/javascript"> + // WebSocket tests are not supported on Android yet. Bug 1566168 + const { AppConstants } = SpecialPowers.ChromeUtils.importESModule( + "resource://gre/modules/AppConstants.sys.mjs" + ); + if (AppConstants.platform !== "android") { + var mySocket = new WebSocket("ws://example.com/tests/dom/security/test/https-only/file_upgrade_insecure"); + mySocket.onopen = function(e) { + if (mySocket.url.includes("wss://")) { + window.parent.postMessage({result: "websocket-ok"}, "*"); + } + else { + window.parent.postMessage({result: "websocket-error"}, "*"); + } + mySocket.close(); + }; + mySocket.onerror = function(e) { + // debug information for Bug 1316305 + dump(" xxx mySocket.onerror: (mySocket): " + mySocket + "\n"); + dump(" xxx mySocket.onerror: (mySocket.url): " + mySocket.url + "\n"); + dump(" xxx mySocket.onerror: (e): " + e + "\n"); + dump(" xxx mySocket.onerror: (e.message): " + e.message + "\n"); + dump(" xxx mySocket.onerror: This might be related to Bug 1316305!\n"); + window.parent.postMessage({result: "websocket-unexpected-error"}, "*"); + }; + } + </script> + + <!-- form action: (upgrade POST from http:// to https://) --> + <iframe name='formFrame' id='formFrame'></iframe> + <form target="formFrame" action="http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?form" method="POST"> + <input name="foo" value="foo"> + <input type="submit" id="submitButton" formenctype='multipart/form-data' value="Submit form"> + </form> + <script type="text/javascript"> + var submitButton = document.getElementById('submitButton'); + submitButton.click(); + </script> + +</body> +</html> diff --git a/dom/security/test/https-only/file_upgrade_insecure_server.sjs b/dom/security/test/https-only/file_upgrade_insecure_server.sjs new file mode 100644 index 0000000000..7cf590141c --- /dev/null +++ b/dom/security/test/https-only/file_upgrade_insecure_server.sjs @@ -0,0 +1,112 @@ +// SJS file for HTTPS-Only Mode mochitests +// Bug 1613063 - HTTPS Only Mode + +const TOTAL_EXPECTED_REQUESTS = 11; + +const IFRAME_CONTENT = + "<!DOCTYPE HTML>" + + "<html>" + + "<head><meta charset='utf-8'>" + + "<title>Bug 1613063 - HTTPS Only Mode</title>" + + "</head>" + + "<body>" + + "<img src='http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?nested-img'></img>" + + "</body>" + + "</html>"; + +const expectedQueries = [ + "script", + "style", + "img", + "iframe", + "form", + "xhr", + "media", + "object", + "font", + "img-redir", + "nested-img", +]; + +function handleRequest(request, response) { + // avoid confusing cache behaviors + response.setHeader("Cache-Control", "no-cache", false); + var queryString = request.queryString; + + // initialize server variables and save the object state + // of the initial request, which returns async once the + // server has processed all requests. + if (queryString == "queryresult") { + setState("totaltests", TOTAL_EXPECTED_REQUESTS.toString()); + setState("receivedQueries", ""); + response.processAsync(); + setObjectState("queryResult", response); + return; + } + + // handle img redirect (https->http) + if (queryString == "redirect-image") { + var newLocation = + "http://example.com/tests/dom/security/test/https-only/file_upgrade_insecure_server.sjs?img-redir"; + response.setStatusLine("1.1", 302, "Found"); + response.setHeader("Location", newLocation, false); + return; + } + + // just in case error handling for unexpected queries + if (!expectedQueries.includes(queryString)) { + response.write("unexpected-response"); + return; + } + + // make sure all the requested queries are indeed https + queryString += request.scheme == "https" ? "-ok" : "-error"; + + var receivedQueries = getState("receivedQueries"); + + // images, scripts, etc. get queried twice, do not + // confuse the server by storing the preload as + // well as the actual load. If either the preload + // or the actual load is not https, then we would + // append "-error" in the array and the test would + // fail at the end. + if (receivedQueries.includes(queryString)) { + return; + } + + // append the result to the total query string array + if (receivedQueries != "") { + receivedQueries += ","; + } + receivedQueries += queryString; + setState("receivedQueries", receivedQueries); + + // keep track of how many more requests the server + // is expecting + var totaltests = parseInt(getState("totaltests")); + totaltests -= 1; + setState("totaltests", totaltests.toString()); + + // return content (img) for the nested iframe to test + // that subresource requests within nested contexts + // get upgraded as well. We also have to return + // the iframe context in case of an error so we + // can test both, using upgrade-insecure as well + // as the base case of not using upgrade-insecure. + if (queryString == "iframe-ok" || queryString == "iframe-error") { + response.write(IFRAME_CONTENT); + } + + // if we have received all the requests, we return + // the result back. + if (totaltests == 0) { + getObjectState("queryResult", function (queryResponse) { + if (!queryResponse) { + return; + } + receivedQueries = getState("receivedQueries"); + queryResponse.write(receivedQueries); + queryResponse.finish(); + }); + } +} diff --git a/dom/security/test/https-only/file_upgrade_insecure_wsh.py b/dom/security/test/https-only/file_upgrade_insecure_wsh.py new file mode 100644 index 0000000000..b7159c742b --- /dev/null +++ b/dom/security/test/https-only/file_upgrade_insecure_wsh.py @@ -0,0 +1,6 @@ +def web_socket_do_extra_handshake(request): + pass + + +def web_socket_transfer_data(request): + pass diff --git a/dom/security/test/https-only/file_user_gesture.html b/dom/security/test/https-only/file_user_gesture.html new file mode 100644 index 0000000000..ac67064bf0 --- /dev/null +++ b/dom/security/test/https-only/file_user_gesture.html @@ -0,0 +1,11 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Bug 1725026 - HTTPS Only Mode - Test if a load triggered by a user gesture can be upgraded to HTTPS</title> +</head> +<body> + <button id="httpLinkButton" onclick="location.href='http://example.com/tests/dom/security/test/https-only/file_console_logging.html'" type="button"> + button</button> +</body> +</html> diff --git a/dom/security/test/https-only/file_websocket_exceptions.html b/dom/security/test/https-only/file_websocket_exceptions.html new file mode 100644 index 0000000000..6c6ba07480 --- /dev/null +++ b/dom/security/test/https-only/file_websocket_exceptions.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<head> +<meta charset="utf-8"> +</head> +<body> + Dummy file which gets iframe injected<br/> +</body> +</html> diff --git a/dom/security/test/https-only/file_websocket_exceptions_iframe.html b/dom/security/test/https-only/file_websocket_exceptions_iframe.html new file mode 100644 index 0000000000..23c6af2d45 --- /dev/null +++ b/dom/security/test/https-only/file_websocket_exceptions_iframe.html @@ -0,0 +1,30 @@ +<!DOCTYPE HTML> +<html> +<head> +<meta charset="utf-8"> +<script> + +window.addEventListener("message", receiveMessage); +function receiveMessage(event) { + window.removeEventListener("message", receiveMessage); + + var mySocket = new WebSocket("ws://example.com/tests/dom/security/test/https-only/file_upgrade_insecure"); + mySocket.onopen = function(e) { + parent.dispatchEvent(new CustomEvent("WebSocketEnded", { + detail: { url: mySocket.url, state: "onopen" } + })); + mySocket.close(); + }; + mySocket.onerror = function(e) { + parent.dispatchEvent(new CustomEvent("WebSocketEnded", { + detail: { url: mySocket.url, state: "onerror" } + })); + mySocket.close(); + }; +} +</script> +</head> +<body> + Https-Only: WebSocket exemption test in iframe</br> +</body> +</html> diff --git a/dom/security/test/https-only/hsts_headers.sjs b/dom/security/test/https-only/hsts_headers.sjs new file mode 100644 index 0000000000..72e82caaf3 --- /dev/null +++ b/dom/security/test/https-only/hsts_headers.sjs @@ -0,0 +1,24 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +function handleRequest(request, response) { + if (request.queryString === "reset") { + // Reset the HSTS policy, prevent influencing other tests + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Strict-Transport-Security", "max-age=0"); + response.write("Resetting HSTS"); + return; + } + let hstsHeader = "max-age=60"; + response.setHeader("Strict-Transport-Security", hstsHeader); + response.setHeader("Cache-Control", "no-cache", false); + response.setHeader("Content-Type", "text/html", false); + // Set header for csp upgrade + response.setHeader( + "Content-Security-Policy", + "upgrade-insecure-requests", + false + ); + response.setStatusLine(request.httpVersion, 200); + response.write("<!DOCTYPE html><html><body><h1>Ok!</h1></body></html>"); +} diff --git a/dom/security/test/https-only/mochitest.toml b/dom/security/test/https-only/mochitest.toml new file mode 100644 index 0000000000..e7ecd439c4 --- /dev/null +++ b/dom/security/test/https-only/mochitest.toml @@ -0,0 +1,65 @@ +[DEFAULT] +support-files = [ + "file_redirect.sjs", + "file_upgrade_insecure.html", + "file_upgrade_insecure_server.sjs", + "file_upgrade_insecure_wsh.py", +] +prefs = [ + "dom.security.https_first=false", + "security.mixed_content.upgrade_display_content=false", +] + +["test_break_endless_upgrade_downgrade_loop.html"] +skip-if = [ + "os == 'android'", # no support for error pages, Bug 1697866 + "http3", + "http2", +] +support-files = [ + "file_break_endless_upgrade_downgrade_loop.sjs", + "file_user_gesture.html", +] + +["test_fragment.html"] +support-files = ["file_fragment.html"] + +["test_http_background_auth_request.html"] +support-files = ["file_http_background_auth_request.sjs"] +skip-if = [ + "http3", + "http2", +] + +["test_http_background_request.html"] +support-files = ["file_http_background_request.sjs"] +skip-if = [ + "http3", + "http2", +] + +["test_insecure_reload.html"] +support-files = ["file_insecure_reload.sjs"] +skip-if = ["os == 'android'"] # no https-only errorpage support in android + +["test_redirect_upgrade.html"] +scheme = "https" +fail-if = ["xorigin"] +skip-if = [ + "http3", + "http2", +] + +["test_resource_upgrade.html"] +scheme = "https" +skip-if = [ + "http3", + "http2", +] + +["test_user_suggestion_box.html"] +skip-if = [ + "os == 'android'", # no https-only errorpage support in android + "http3", + "http2", +] diff --git a/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html b/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html new file mode 100644 index 0000000000..847a71f378 --- /dev/null +++ b/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html @@ -0,0 +1,89 @@ +<!DOCTYPE HTML> +<html> +<head> +<title>Bug 1691888: Break endless upgrade downgrade loops when using https-only</title> +<script src="/tests/SimpleTest/SimpleTest.js"></script> +<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> +"use strict"; +/* + * Description of the test: + * We perform three tests where our upgrade/downgrade redirect loop detector should break the + * endless loop: + * Test 1: Meta Refresh + * Test 2: JS Redirect + * Test 3: 302 redirect + */ + +SimpleTest.requestFlakyTimeout("We need to wait for the HTTPS-Only error page to appear"); +SimpleTest.requestLongerTimeout(10); +SimpleTest.waitForExplicitFinish(); + +const REQUEST_URL = + "http://example.com/tests/dom/security/test/https-only/file_break_endless_upgrade_downgrade_loop.sjs"; + +function resolveAfter6Seconds() { + return new Promise(resolve => { + setTimeout(() => { + resolve(); + }, 6000); + }); +} + +async function verifyResult(aTestName) { + let errorPageL10nId = "about-httpsonly-title-alert"; + let innerHTML = content.document.body.innerHTML; + ok(innerHTML.includes(errorPageL10nId), "the error page should be shown for " + aTestName); +} + +async function verifyTest4Result() { + let pathname = content.document.location.pathname; + ok( + pathname === "/tests/dom/security/test/https-only/file_user_gesture.html", + "the http:// page should be loaded" + ); +} + +async function runTests() { + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ["dom.security.https_only_mode_break_upgrade_downgrade_endless_loop", true], + ["dom.security.https_only_check_path_upgrade_downgrade_endless_loop", true], + ]}); + + // Test 1: Meta Refresh Redirect + let winTest1 = window.open(REQUEST_URL + "?test1a", "_blank"); + // Test 2: JS win.location Redirect + let winTest2 = window.open(REQUEST_URL + "?test2a", "_blank"); + // Test 3: 302 Redirect + let winTest3 = window.open(REQUEST_URL + "?test3a", "_blank"); + // Test 4: 302 Redirect with a different path + let winTest4 = window.open(REQUEST_URL + "?test4a", "_blank"); + + // provide enough time for: + // the redirects to occur, and the error page to be displayed + await resolveAfter6Seconds(); + + await SpecialPowers.spawn(winTest1, ["test1"], verifyResult); + winTest1.close(); + + await SpecialPowers.spawn(winTest2, ["test2"], verifyResult); + winTest2.close(); + + await SpecialPowers.spawn(winTest3, ["test3"], verifyResult); + winTest3.close(); + + await SpecialPowers.spawn(winTest4, ["test4"], verifyTest4Result); + winTest4.close(); + + SimpleTest.finish(); +} + +runTests(); + +</script> +</body> +</html> diff --git a/dom/security/test/https-only/test_fragment.html b/dom/security/test/https-only/test_fragment.html new file mode 100644 index 0000000000..52a63764fb --- /dev/null +++ b/dom/security/test/https-only/test_fragment.html @@ -0,0 +1,72 @@ +<!DOCTYPE HTML> +<html> +<head> +<title>Bug 1694932: Https-only mode reloads the page in certain cases when there should be just a fragment navigation </title> +<script src="/tests/SimpleTest/SimpleTest.js"></script> +<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> +"use strict"; +/* + * Description of the test: + * Perform a test where a button click leads to scroll the page. Test if https-only detects + * that the redirection address of the button is on the same page. Instead of a reload https-only + * should only scroll. + * + * Test: + * Enable https-only and load the url + * Load: http://mozilla.pettay.fi/moztests/fragment.html + * Click "Click me" + * The page should be scrolled down to 'foo' without a reload + * It shouldn't receive a message 'before unload' because the on before unload + * function in file_fragment.html should not be called + */ + +SimpleTest.waitForExplicitFinish(); + +const REQUEST_URL = "http://example.com/tests/dom/security/test/https-only/file_fragment.html"; +const EXPECT_URL = REQUEST_URL.replace("http://", "https://"); +let winTest = null; +let checkButtonClicked = false; + +async function receiveMessage(event) { + let data = event.data; + // checks if click was successful + if (!checkButtonClicked){ + // expected window location ( expected URL) + ok(data.result == EXPECT_URL, "location is correct"); + ok(data.button, "button is clicked"); + // checks if loading was successful + ok(data.info == "onload", "Onloading worked"); + // button was clicked + checkButtonClicked = true; + return; + } + // if Button was clicked once -> test finished + // check if hash exist and if hash of location is correct + ok(data.button, "button is clicked"); + ok(data.result == EXPECT_URL + "#foo", "location (hash) is correct"); + // check that page is scrolled not reloaded + ok(data.info == "scrolled-to-foo","Scrolled successfully without reloading!"); + is(data.documentURI, EXPECT_URL + "#foo", "Document URI is correct"); + // complete test and close window + window.removeEventListener("message",receiveMessage); + winTest.close(); + SimpleTest.finish(); +} + +async function runTest() { + //Test: With https-only mode activated + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ]}); + winTest = window.open(REQUEST_URL); +} +window.addEventListener("message", receiveMessage); +runTest(); + +</script> +</body> +</html> diff --git a/dom/security/test/https-only/test_http_background_auth_request.html b/dom/security/test/https-only/test_http_background_auth_request.html new file mode 100644 index 0000000000..5a7bf665b9 --- /dev/null +++ b/dom/security/test/https-only/test_http_background_auth_request.html @@ -0,0 +1,113 @@ +<!DOCTYPE HTML> +<html> +<head> + <title>Bug 1665062 - HTTPS-Only: Do not cancel channel if auth is in progress</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> + +/* + * Description of the test: + * We send a top-level request which results in a '401 - Unauthorized' and ensure that the + * http background request does not accidentally treat that request as a potential timeout. + * We make sure that ther HTTPS-Only Mode Error Page does *NOT* show up. + */ + +const { AppConstants } = SpecialPowers.ChromeUtils.importESModule( + "resource://gre/modules/AppConstants.sys.mjs" +); + +SimpleTest.waitForExplicitFinish(); +SimpleTest.requestFlakyTimeout("When Auth is in progress, HTTPS-Only page should not show up"); +SimpleTest.requestLongerTimeout(10); + +const EXPECTED_KICK_OFF_REQUEST = + "http://test1.example.com/tests/dom/security/test/https-only/file_http_background_auth_request.sjs?foo"; +const EXPECTED_UPGRADE_REQUEST = EXPECTED_KICK_OFF_REQUEST.replace("http://", "https://"); +let EXPECTED_BG_REQUEST = "http://test1.example.com/"; +let requestCounter = 0; + +function examiner() { + SpecialPowers.addObserver(this, "specialpowers-http-notify-request"); +} +examiner.prototype = { + observe(subject, topic, data) { + if (topic !== "specialpowers-http-notify-request") { + return; + } + + // On Android we have other requests appear here as well. Let's make + // sure we only evaluate requests triggered by the test. + if (!data.startsWith("http://test1.example.com") && + !data.startsWith("https://test1.example.com")) { + return; + } + ++requestCounter; + if (requestCounter == 1) { + is(data, EXPECTED_KICK_OFF_REQUEST, "kick off request needs to be http"); + return; + } + if (requestCounter == 2) { + is(data, EXPECTED_UPGRADE_REQUEST, "upgraded request needs to be https"); + return; + } + if (requestCounter == 3) { + is(data, EXPECTED_BG_REQUEST, "background request needs to be http and no sensitive info"); + return; + } + ok(false, "we should never get here, but just in case"); + }, + remove() { + SpecialPowers.removeObserver(this, "specialpowers-http-notify-request"); + } +} +window.AuthBackgroundRequestExaminer = new examiner(); + +// https-only top-level background request occurs after 3 seconds, hence +// we use 4 seconds to make sure the background request did not happen. +function resolveAfter4Seconds() { + return new Promise(resolve => { + setTimeout(() => { + resolve(); + }, 4000); + }); +} + +async function runTests() { + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ["dom.security.https_only_mode_send_http_background_request", true], + ]}); + + let testWin = window.open(EXPECTED_KICK_OFF_REQUEST, "_blank"); + + // Give the Auth Process and background request some time before moving on. + await resolveAfter4Seconds(); + + if (AppConstants.platform !== "android") { + is(requestCounter, 3, "three requests total (kickoff, upgraded, background)"); + } else { + // On Android, the auth request resolves and hence the background request + // is not even kicked off - nevertheless, the error page should not appear! + is(requestCounter, 2, "two requests total (kickoff, upgraded)"); + } + + await SpecialPowers.spawn(testWin, [], () => { + let innerHTML = content.document.body.innerHTML; + is(innerHTML, "", "expection page should not be displayed"); + }); + + testWin.close(); + + window.AuthBackgroundRequestExaminer.remove(); + SimpleTest.finish(); +} + +runTests(); + +</script> +</body> +</html> diff --git a/dom/security/test/https-only/test_http_background_request.html b/dom/security/test/https-only/test_http_background_request.html new file mode 100644 index 0000000000..5dff0a5fdb --- /dev/null +++ b/dom/security/test/https-only/test_http_background_request.html @@ -0,0 +1,125 @@ +<!DOCTYPE HTML> +<html> +<head> + <title>Bug 1663396: Test HTTPS-Only-Mode top-level background request not leaking sensitive info</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> + +/* + * Description of the test: + * Send a top-level request and make sure that the the top-level https-only background request + * (a) does only use pre-path information + * (b) does not happen if the pref is set to false + */ + +SimpleTest.waitForExplicitFinish(); +SimpleTest.requestFlakyTimeout("have to test that https-only mode background request does not happen"); +SimpleTest.requestLongerTimeout(8); + +const SJS_PATH = "tests/dom/security/test/https-only/file_http_background_request.sjs?sensitive"; + +const EXPECTED_KICK_OFF_REQUEST = "http://example.com/" + SJS_PATH; +const EXPECTED_KICK_OFF_REQUEST_LOCAL = "http://localhost:8/" + SJS_PATH; +const EXPECTED_UPGRADE_REQUEST = EXPECTED_KICK_OFF_REQUEST.replace("http://", "https://"); +let expectedBackgroundRequest = ""; +let requestCounter = 0; + +function examiner() { + SpecialPowers.addObserver(this, "specialpowers-http-notify-request"); +} +examiner.prototype = { + observe(subject, topic, data) { + if (topic !== "specialpowers-http-notify-request") { + return; + } + // On Android we have other requests appear here as well. Let's make + // sure we only evaluate requests triggered by the test. + if (!data.startsWith("http://example.com") && + !data.startsWith("https://example.com") && + !data.startsWith("http://localhost:8") && + !data.startsWith("https://localhost:8")) { + return; + } + ++requestCounter; + if (requestCounter == 1) { + ok( + data === EXPECTED_KICK_OFF_REQUEST || data === EXPECTED_KICK_OFF_REQUEST_LOCAL, + "kick off request needs to be http" + ); + return; + } + if (requestCounter == 2) { + is(data, EXPECTED_UPGRADE_REQUEST, "upgraded request needs to be https"); + return; + } + if (requestCounter == 3) { + is(data, expectedBackgroundRequest, "background request needs to be http and no sensitive info like path"); + return; + } + ok(false, "we should never get here, but just in case"); + }, + remove() { + SpecialPowers.removeObserver(this, "specialpowers-http-notify-request"); + } +} +window.BackgroundRequestExaminer = new examiner(); + +// https-only top-level background request occurs after 3 seconds, hence +// we use 4 seconds to make sure the background request did not happen. +function resolveAfter4Seconds() { + return new Promise(resolve => { + setTimeout(() => { + resolve(); + }, 4000); + }); +} + +async function runTests() { + // (a) Test http background request to only use prePath information + expectedBackgroundRequest = "http://example.com/"; + requestCounter = 0; + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ["dom.security.https_only_mode_send_http_background_request", true], + ["dom.security.https_only_mode_error_page_user_suggestions", false], + ]}); + let testWin = window.open(EXPECTED_KICK_OFF_REQUEST, "_blank"); + await resolveAfter4Seconds(); + is(requestCounter, 3, "three requests total (kickoff, upgraded, background)"); + testWin.close(); + + // (x) Test no http background request happens when localhost + expectedBackgroundRequest = ""; + requestCounter = 0; + testWin = window.open(EXPECTED_KICK_OFF_REQUEST_LOCAL, "_blank"); + await resolveAfter4Seconds(); + is(requestCounter, 1, "one requests total (kickoff, no upgraded, no background)"); + testWin.close(); + + // (b) Test no http background request happens if pref is set to false + expectedBackgroundRequest = ""; + requestCounter = 0; + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ["dom.security.https_only_mode_send_http_background_request", false], + ["dom.security.https_only_mode_error_page_user_suggestions", false], + ]}); + testWin = window.open(EXPECTED_KICK_OFF_REQUEST, "_blank"); + await resolveAfter4Seconds(); + is(requestCounter, 2, "two requests total (kickoff, upgraded, no background)"); + testWin.close(); + + // clean up and finish tests + window.BackgroundRequestExaminer.remove(); + SimpleTest.finish(); +} + +runTests(); + +</script> +</body> +</html> diff --git a/dom/security/test/https-only/test_insecure_reload.html b/dom/security/test/https-only/test_insecure_reload.html new file mode 100644 index 0000000000..d143c9080b --- /dev/null +++ b/dom/security/test/https-only/test_insecure_reload.html @@ -0,0 +1,74 @@ +<!DOCTYPE HTML> +<html> +<head> +<title>Bug 1702001: Https-only mode does not reload pages after clicking "Continue to HTTP Site", when url contains navigation </title> +<script src="/tests/SimpleTest/SimpleTest.js"></script> +<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> +"use strict"; +/* + * Description of the test: + * + * Load a page including a fragment portion which does not support https and make + * sure that exempting the page from https-only-mode does not result in a fragment + * navigation. + */ + + + function resolveAfter6Seconds() { + return new Promise(resolve => { + setTimeout(() => { + resolve(); + }, 6000); + }); +} + +SimpleTest.requestFlakyTimeout("We need to wait for the HTTPS-Only error page to appear"); +SimpleTest.waitForExplicitFinish(); + +let winTest = null; +let TEST_URL = "http://example.com/tests/dom/security/test/https-only/file_insecure_reload.sjs#nav"; + +// verify that https-only page appeared +async function verifyErrorPage() { + let errorPageL10nId = "about-httpsonly-title-alert"; + let innerHTML = content.document.body.innerHTML; + ok(innerHTML.includes(errorPageL10nId), "the error page should be shown for "); + let button = content.document.getElementById("openInsecure"); + // Click "Continue to HTTP Site" + ok(button, "button exist"); + if(button) { + button.click(); + } +} +// verify that you entered the page and are not still displaying +// the https-only error page +async function receiveMessage(event) { + // read event + let { result, historyLength } = event.data; + is(result, "you entered the http page", "The requested page should be shown"); + is(historyLength, 1, "History should contain one item"); + window.removeEventListener("message",receiveMessage); + winTest.close(); + SimpleTest.finish(); +} + + +async function runTest() { + //Test: With https-only mode activated + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ]}); + winTest = window.open(TEST_URL); + await resolveAfter6Seconds(); + await SpecialPowers.spawn(winTest,[],verifyErrorPage); +} +window.addEventListener("message", receiveMessage); +runTest(); + +</script> +</body> +</html> diff --git a/dom/security/test/https-only/test_redirect_upgrade.html b/dom/security/test/https-only/test_redirect_upgrade.html new file mode 100644 index 0000000000..59f02f96d0 --- /dev/null +++ b/dom/security/test/https-only/test_redirect_upgrade.html @@ -0,0 +1,58 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=1613063 +Test that 302 redirect requests get upgraded to https:// with HTTPS-Only Mode enabled +--> + +<head> + <title>HTTPS-Only Mode - XHR Redirect Upgrade</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> + +<body> + <h1>HTTPS-Only Mode</h1> + <p>Upgrade Test for insecure XHR redirects.</p> + <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1613063">Bug 1613063</a> + + <script type="application/javascript"> + + const redirectCodes = ["301", "302", "303", "307"] + let currentTest = 0 + + function startTest() { + const currentCode = redirectCodes[currentTest]; + + const myXHR = new XMLHttpRequest(); + // Make a request to a site (eg. https://file_redirect.sjs?301), which will redirect to http://file_redirect.sjs?check. + // The response will either be secure-ok, if the request has been upgraded to https:// or secure-error if it didn't. + myXHR.open("GET", `https://example.com/tests/dom/security/test/https-only/file_redirect.sjs?${currentCode}`); + myXHR.onload = (e) => { + is(myXHR.responseText, "secure-ok", `a ${currentCode} redirect when posting violation report should be blocked`) + testDone(); + } + // This should not happen + myXHR.onerror = (e) => { + ok(false, `Could not query results from server for ${currentCode}-redirect test (" + e.message + ")`); + testDone(); + } + myXHR.send(); + } + + function testDone() { + // Check if there are remaining tests + if (++currentTest < redirectCodes.length) { + startTest() + } else { + SimpleTest.finish(); + } + } + + SimpleTest.waitForExplicitFinish(); + // Set preference and start test + SpecialPowers.pushPrefEnv({ set: [["dom.security.https_only_mode", true]] }, startTest); + + </script> +</body> +</html> diff --git a/dom/security/test/https-only/test_resource_upgrade.html b/dom/security/test/https-only/test_resource_upgrade.html new file mode 100644 index 0000000000..6584bad020 --- /dev/null +++ b/dom/security/test/https-only/test_resource_upgrade.html @@ -0,0 +1,122 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + <title>HTTPS-Only Mode - Resource Upgrade</title> + <!-- Including SimpleTest.js so we can use waitForExplicitFinish !--> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> + +<body> + <h1>HTTPS-Only Mode</h1> + <p>Upgrade Test for various resources</p> + <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1613063">Bug 1613063</a> + <iframe style="width:100%;" id="testframe"></iframe> + + <script class="testbody" type="text/javascript"> + /* Description of the test: + * We load resources (img, script, sytle, etc) over *http* and make sure + * that all the resources get upgraded to use >> https << when the + * preference "dom.security.https_only_mode" is set to true. We further + * test that subresources within nested contexts (iframes) get upgraded + * and also test the handling of server side redirects. + * + * In detail: + * We perform an XHR request to the *.sjs file which is processed async on + * the server and waits till all the requests were processed by the server. + * Once the server received all the different requests, the server responds + * to the initial XHR request with an array of results which must match + * the expected results from each test, making sure that all requests + * received by the server (*.sjs) were actually *https* requests. + */ + + const { AppConstants } = SpecialPowers.ChromeUtils.importESModule( + "resource://gre/modules/AppConstants.sys.mjs" + ); + const splitRegex = /^(.*)-(.*)$/ + const testConfig = { + topLevelScheme: "http://", + results: [ + "iframe", "script", "img", "img-redir", "font", "xhr", "style", + "media", "object", "form", "nested-img" + ] + } + // TODO: WebSocket tests are not supported on Android Yet. Bug 1566168. + if (AppConstants.platform !== "android") { + testConfig.results.push("websocket"); + } + + + function runTest() { + // sends an xhr request to the server which is processed async, which only + // returns after the server has received all the expected requests. + var myXHR = new XMLHttpRequest(); + myXHR.open("GET", "file_upgrade_insecure_server.sjs?queryresult"); + myXHR.onload = function (e) { + var results = myXHR.responseText.split(","); + for (var index in results) { + checkResult(results[index]); + } + } + myXHR.onerror = function (e) { + ok(false, "Could not query results from server (" + e.message + ")"); + finishTest(); + } + myXHR.send(); + + // give it some time and run the testpage + SimpleTest.executeSoon(() => { + var src = testConfig.topLevelScheme + "example.com/tests/dom/security/test/https-only/file_upgrade_insecure.html"; + document.getElementById("testframe").src = src; + }); + } + + // a postMessage handler that is used by sandboxed iframes without + // 'allow-same-origin' to bubble up results back to this main page. + window.addEventListener("message", receiveMessage); + function receiveMessage(event) { + checkResult(event.data.result); + } + + function finishTest() { + window.removeEventListener("message", receiveMessage); + SimpleTest.finish(); + } + + function checkResult(response) { + // A response looks either like this "iframe-ok" or "[key]-[result]" + const [, key, result] = splitRegex.exec(response) + // try to find the expected result within the results array + var index = testConfig.results.indexOf(key); + + // If the response is not even part of the results array, something is super wrong + if (index == -1) { + ok(false, `Unexpected response from server (${response})`); + finishTest(); + } + + // take the element out the array and continue till the results array is empty + if (index != -1) { + testConfig.results.splice(index, 1); + } + + // Check if the result was okay or had an error + is(result, 'ok', `Upgrade all requests on toplevel http for '${key}' came back with: '${result}'`) + + // If we're not expecting any more resulsts, finish the test + if (!testConfig.results.length) { + finishTest(); + } + } + + SimpleTest.waitForExplicitFinish(); + + // Set preference and start test + SpecialPowers.pushPrefEnv({ set: [["dom.security.https_only_mode", true]] }, runTest); + + </script> +</body> + +</html> diff --git a/dom/security/test/https-only/test_user_suggestion_box.html b/dom/security/test/https-only/test_user_suggestion_box.html new file mode 100644 index 0000000000..1feabcd003 --- /dev/null +++ b/dom/security/test/https-only/test_user_suggestion_box.html @@ -0,0 +1,81 @@ +<!DOCTYPE html> +<html> +<head> + <title>Bug 1665057 - Add www button on https-only error page</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script class="testbody" type="text/javascript"> +"use strict"; + +/* + * Description of the test: + * We send a top-level request to a http-page in https-only mode + * The page has a bad certificate and can't be updated so the error page appears + * If there is a secure connection possible to www the suggestion-box on the error page + * should appear and have a link to that secure www-page + * if the original-pagerequest already has a www or there is no secure www connection + * the suggestion box should not appear + */ + +SimpleTest.requestFlakyTimeout("We need to wait for the HTTPS-Only error page to appear and for the additional 'www' request to provide a suggestion."); +SimpleTest.requestLongerTimeout(10); + +// urls of server locations with bad cert -> https-only should display error page +const KICK_OFF_REQUEST_WITH_SUGGESTION = "http://suggestion-example.com"; +const KICK_OFF_REQUEST_WITHOUT_SUGGESTION = "http://no-suggestion-example.com"; + +// l10n ids to compare html to +const ERROR_PAGE_L10N_ID = "about-httpsonly-title-alert"; +const SUGGESTION_BOX_L10N_ID = "about-httpsonly-suggestion-box-www-text"; + +// the error page needs to be build and a background https://www request needs to happen +// we use 4 seconds to make sure these requests did happen. +function resolveAfter4Seconds() { + return new Promise(resolve => { + setTimeout(() => { + resolve(); + }, 4000); + }); +} + +async function runTests(aMessage) { + let errorPageL10nId = "about-httpsonly-title-alert"; + let suggestionBoxL10nId = "about-httpsonly-suggestion-box-www-text"; + + let innerHTML = content.document.body.innerHTML; + + if (aMessage === "with_suggestion") { + // test if the page with suggestion shows the error page and the suggestion box + ok(innerHTML.includes(errorPageL10nId), "the error page should be shown."); + ok(innerHTML.includes(suggestionBoxL10nId), "the suggestion box should be shown."); + } else if (aMessage === "without_suggestion") { + // test if the page without suggestion shows the error page but not the suggestion box + ok(innerHTML.includes(errorPageL10nId), "the error page should be shown."); + ok(!innerHTML.includes(suggestionBoxL10nId), "the suggestion box should not be shown."); + } else { + ok(false, "we should never get here"); + } +} + +add_task(async function() { + await SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_only_mode", true], + ["dom.security.https_only_mode_send_http_background_request", false], + ["dom.security.https_only_mode_error_page_user_suggestions", true], + ]}); + let testWinSuggestion = window.open(KICK_OFF_REQUEST_WITH_SUGGESTION, "_blank"); + let testWinWithoutSuggestion = window.open(KICK_OFF_REQUEST_WITHOUT_SUGGESTION, "_blank"); + + await resolveAfter4Seconds(); + + await SpecialPowers.spawn(testWinSuggestion, ["with_suggestion"], runTests); + await SpecialPowers.spawn(testWinWithoutSuggestion, ["without_suggestion"], runTests); + + testWinSuggestion.close(); + testWinWithoutSuggestion.close(); +}); +</script> +</body> +</html> |