Issue metadata
Sign in to add a comment
|
HTTPBad Sensitive Input warning doesn't show when HTTP frames HTTPS page |
||||||||||||||||||||||
Issue descriptionChrome Version: 60 OS: iOS 10.3 What steps will reproduce the problem? (1) Visit a page with a HTTP page framing a HTTPS page containing a password input (e.g. http://webdbg.com/test/forms/FramePassword.asp) Expect: (i) indicator appears in omnibox because the input is not in a secure context. Actual: (i) does not appear. I originally thought this might be caused by how we check the security of the Origin (rather than the security of the Context), e.g. web::IsOriginSecure(self.webState->GetLastCommittedURL()); but now I'm thinking this might be yet another limitation in our surfacing the OnPasswordInputShownOnHttp signal from the iOS password manager (e.g. perhaps it doesn't look for forms in cross-origin subframes). https://cs.chromium.org/chromium/src/ios/chrome/browser/passwords/password_controller.mm?l=562&rcl=80761605e4fc0b7cb8ae7aa67e0a1c4c12baaa3e
,
Feb 18 2018
,
Aug 7
,
Aug 7
Emily, is this something that your team can take?
,
Aug 7
I can take a look at this, although I'm not as familiar with form handling on iOS. Testing on desktop and Android, editing _any_ framed text input correctly causes the (i) icon to downgrade to the red "dangerous" triangle.
,
Aug 7
Specifically, the InsecureInputTabHelper is supposed to listen for form activity via:
void InsecureInputTabHelper::OnFormActivity(
web::WebState* web_state,
const web::FormActivityParams& params) {
DCHECK_EQ(web_state_, web_state);
if (params.type == "input" &&
!web::IsOriginSecure(web_state->GetLastCommittedURL())) {
DidEditFieldInInsecureContext();
}
}
The problem is that FormActivityObserver::OnFormActivity is _explicitly_ only called for same-origin frames:
https://cs.chromium.org/chromium/src/components/autofill/ios/form_util/form_activity_observer.h?dr=CSs&g=0&l=27
So I'm not sure if there is a way to fix this on iOS without re-architecting how we're getting the signal that form edits are happening.
,
Aug 7
Soon InsecureInputTabHelper::OnFormActivity will be called for cross-origin iframes. Mike, could you please mark this bug as blocked on cross-origin iframes refactoring bug.
,
Aug 7
,
Oct 30
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by est...@chromium.org
, Nov 10 2017