Chrome Remote Desktop Host downloads installer non-securely |
||||||
Issue description
Version: 49.0.2623.87 (Official Build) beta-m (64-bit)
OS: Windows 10
What steps will reproduce the problem?
Attempt to install the Chrome Remote Desktop host installer for Windows
Expect: HTTPS download
Actual: HTTP navigation
host_installer.js contains:
var HOST_DOWNLOAD_URLS = {
'Win32': 'http://dl.google.com/dl/edgedl/chrome-remote-desktop/' +
'chromeremotedesktophost.msi',
'Win64': 'http://dl.google.com/dl/edgedl/chrome-remote-desktop/' +
'chromeremotedesktophost.msi',
'MacIntel': 'https://dl.google.com/chrome-remote-desktop/' +
'chromeremotedesktop.dmg',
'Linux x86_64': 'https://dl.google.com/linux/direct/' +
'chrome-remote-desktop_current_amd64.deb',
'Linux i386': 'https://dl.google.com/linux/direct/' +
'chrome-remote-desktop_current_i386.deb',
'Linux i686': 'https://dl.google.com/linux/direct/' +
'chrome-remote-desktop_current_i386.deb'
};
,
Mar 28 2016
If the site doesn't upgrade to HTTPS and send a dynamic HSTS header, that should still be considered a bug.
,
Mar 28 2016
(Also, I don't know if host_installer.js is part of the site in question, but I meant to imply that changing all links to HTTPS is part of proper upgrading.)
,
Mar 29 2016
looks like it should be an easy fix -> elawrence@ the file appears to be https://cs.chromium.org/#chromium/src/remoting/webapp/crd/js/host_installer.js&q=HOST_DOWNLOAD_URLS&l=79
,
Mar 29 2016
Would be nice to fix other URLs as well: https://code.google.com/p/chromium/codesearch#search/&q=%22http://dl.google.com%22&sq=package:chromium&type=cs
,
Apr 20 2016
,
Apr 20 2016
Issue 605328 has been merged into this issue.
,
Apr 20 2016
Can we open up this bug? Also see bug 507925 for other references to dl.google.com.
,
May 31 2016
Issue 615883 has been merged into this issue.
,
May 31 2016
elawrence: Ping. Is this a matter of simply fixing the URLs?
,
May 31 2016
,
Jun 10 2016
friendly ping, please fix this.
,
Sep 16 2016
Fixing the MSI downloader's path is straightforward, trivial, and shouldn't have any user-visible side-effects due to HSTS. Changing the path for Linux packages (#8/Issue #507925) is another matter entirely, and I think it makes sense to leave that in its own issue.
,
Sep 17 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/bc94e6ac4ddf98fc838684b079d70dae943b55d3 commit bc94e6ac4ddf98fc838684b079d70dae943b55d3 Author: elawrence <elawrence@chromium.org> Date: Sat Sep 17 01:50:46 2016 Change Chrome Remote Desktop MSI download link to use HTTPS BUG= 598338 Review-Url: https://codereview.chromium.org/2347923002 Cr-Commit-Position: refs/heads/master@{#419362} [modify] https://crrev.com/bc94e6ac4ddf98fc838684b079d70dae943b55d3/remoting/webapp/crd/js/host_installer.js
,
Sep 19 2016
Fixed in 55.0.2864.0
,
Nov 18 2016
Issue 666913 has been merged into this issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by elawrence@chromium.org
, Mar 28 2016Hrm. Apparently this is in the current pre-load list, making this rather unimportant. I wasn't getting a HSTS header from the site itself. { "name": "dl.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },