Bug 1720103 - Https-first: Do not upgrade form submissions (for now) r=ckerschb

Differential Revision: https://phabricator.services.mozilla.com/D119882
2021-07-14 15:53:00 +00:00 · 2021-07-14 15:53:00 +00:00 · 3ebe6a7c5d
--- a/dom/security/nsHTTPSOnlyUtils.cpp
+++ b/dom/security/nsHTTPSOnlyUtils.cpp
@ -347,6 +347,11 @@ bool nsHTTPSOnlyUtils::ShouldUpgradeHttpsFirstRequest(nsIURI* aURI,
  if (port != defaultPortforScheme && port != -1) {
    return false;
  }
+  // 6. Do not upgrade form submissions (for now), revisit within
+  // Bug 1720500: Revisit upgrading form submissions.
+  if (aLoadInfo->GetIsFormSubmission()) {
+    return false;
+  }

  // https-first needs to account for breaking upgrade-downgrade endless
  // loops at this point because this function is called before we
--- a/dom/security/test/https-first/file_form_submission.sjs
+++ b/dom/security/test/https-first/file_form_submission.sjs
@ -0,0 +1,84 @@
+const CC = Components.Constructor;
+const BinaryInputStream = CC(
+  "@mozilla.org/binaryinputstream;1",
+  "nsIBinaryInputStream",
+  "setInputStream"
+);
+
+const RESPONSE_SUCCESS = `
+  <html>
+    <body>
+      send message, downgraded
+    <script type="application/javascript">
+      let scheme = document.location.protocol;
+      const loc = document.location.href;
+      window.opener.postMessage({location: loc, scheme: scheme, form:"test=success" }, '*');
+    </script>
+    </body>
+  </html>`;
+
+const POST_FORMULAR = `
+<html>
+    <body>
+        <form action="http://example.com/tests/dom/security/test/https-first/file_form_submission.sjs?" method="POST" id="POSTForm">
+            <div>
+             <label id="submit">Submit</label>
+             <input name="test" id="form" value="success">
+            </div>
+        </form>
+        <script class="testbody" type="text/javascript">
+            document.getElementById("POSTForm").submit();
+        </script>
+    </body>
+</html>
+`;
+
+function handleRequest(request, response) {
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+  let queryString = request.queryString;
+  if (request.scheme === "https" && queryString === "test=1") {
+    response.write(RESPONSE_SUCCESS);
+    return;
+  }
+  if (
+    request.scheme === "https" &&
+    (queryString === "test=2" || queryString === "test=4")
+  ) {
+    // time out request
+    response.processAsync();
+    return;
+  }
+  if (request.scheme === "http" && queryString === "test=2") {
+    response.write(RESPONSE_SUCCESS);
+    return;
+  }
+  if (queryString === "test=3" || queryString === "test=4") {
+    // send post form
+    response.write(POST_FORMULAR);
+    return;
+  }
+  if (request.method == "POST") {
+    // extract form parameters
+    let body = new BinaryInputStream(request.bodyInputStream);
+    let avail;
+    let bytes = [];
+    while ((avail = body.available()) > 0) {
+      Array.prototype.push.apply(bytes, body.readByteArray(avail));
+    }
+    let requestBodyContents = String.fromCharCode.apply(null, bytes);
+
+    response.write(`
+    <html>
+    <script type="application/javascript">
+      let scheme = document.location.protocol;
+      const loc = document.location.href;
+      window.opener.postMessage({location: loc, scheme: scheme, form: '${requestBodyContents}'}, '*');
+    </script>
+  </html>`);
+
+    return;
+  }
+  // we should never get here; just in case, return something unexpected
+  response.write("do'h");
+}
--- a/dom/security/test/https-first/mochitest.ini
+++ b/dom/security/test/https-first/mochitest.ini
@ -26,6 +26,9 @@ support-files= file_referrer_policy.sjs
 [test_break_endless_upgrade_downgrade_loop.html]
 support-files =
  file_break_endless_upgrade_downgrade_loop.sjs
+[test_form_submission.html]
+support-files =
+  file_form_submission.sjs
 [test_bad_cert.html]
 support-files =
  file_bad_cert.sjs
--- a/dom/security/test/https-first/test_form_submission.html
+++ b/dom/security/test/https-first/test_form_submission.html
@ -0,0 +1,122 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Bug 1720103 - Https-first: Do not upgrade form submissions (for now)</title>
+  <script src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<iframe style="width:100%;" id="testframe"></iframe>
+<script class="testbody" type="text/javascript">
+/*
+ * Description of the test:
+ * We test https-first behaviour with forms.
+ * We perform each test with once with same origin and the second time
+ * with a cross origin. We perform two GET form requests and two POST
+ * form requests.
+ * In more detail:
+ *
+ * 1. Test: Request that gets upgraded to https, GET form submission.
+ *
+ * 2. Test: Request that gets upgraded to https, that upgraded request
+ *          gets timed out, so https-first send an http request, GET form submission.
+ *
+ * 3. Test: request that gets upgraded to https, and sends a POST form
+ *          to http://example.com.
+ *
+ * 4. Test: Request where the https upgrade get timed out -> http, and sends a POST form
+ *          to http://example.com,
+ *
+ */
+SimpleTest.waitForExplicitFinish();
+window.addEventListener("message", receiveMessage);
+
+const SAME_ORIGIN = "http://example.com/tests/dom/security/test/https-first/file_form_submission.sjs";
+const CROSS_ORIGIN = SAME_ORIGIN.replace(".com", ".org");
+const Tests = [{
+  // 1. Test GET, gets upgraded
+    query: "?test=1",
+    scheme: "https:",
+    method: "GET",
+    value: "test=success",
+},
+{
+  // 2. Test GET, initial request will be downgraded
+    query:"?test=2",
+    scheme: "http:",
+    method: "GET",
+    value: "test=success"
+},
+{  // 3. Test POST formular, gets upgraded
+    query: "?test=3",
+    scheme: "http:",
+    method: "POST",
+    value: "test=success"
+},
+{   // 4. Test POST formular, request will be downgraded
+    query: "?test=4",
+    scheme: "http:",
+    method: "POST",
+    value: "test=success"
+},
+];
+let currentTest;
+let counter = 0;
+let testWin;
+let sameOrigin = true;
+
+// Verify that top-level request got the expected scheme and reached the correct location.
+async function receiveMessage(event){
+  let data = event.data;
+  let origin = sameOrigin? SAME_ORIGIN : CROSS_ORIGIN
+  const expectedLocation = origin.replace("http:", currentTest.scheme);
+  // If GET request check that form was transfered by url
+  if (currentTest.method === "GET") {
+    is(data.location, expectedLocation + currentTest.query,
+   "Reached the correct location for " + currentTest.query );
+  } else {
+    // Since the form is always send to example.com we expect it here as location
+    is(data.location.includes(SAME_ORIGIN.replace("http:", currentTest.scheme)), true,
+   "Reached the correct location for " + currentTest.query );
+  }
+  is(data.scheme, currentTest.scheme,`${currentTest.query} upgraded or downgraded to ` + currentTest.scheme);
+  // Check that the form value is correct
+  is(data.form, currentTest.value, "Form was transfered");
+  testWin.close();
+  // Flip origin flag
+  sameOrigin ^= true;
+  // Only go to next test if already sent same and cross origin request for current test
+  if (sameOrigin) {
+    counter++;
+  }
+  // Check if we have test left, if not finish the testing
+  if (counter >= Tests.length) {
+    window.removeEventListener("message", receiveMessage);
+    SimpleTest.finish();
+    return;
+  }
+  // If we didn't reached the end yet, run next test
+  runTest();
+}
+
+function runTest() {
+  currentTest = Tests[counter];
+  // If sameOrigin flag is set make a origin request, else a cross origin request
+  if (sameOrigin) {
+    testWin= window.open(SAME_ORIGIN + currentTest.query, "_blank");
+  } else {
+    testWin= window.open(CROSS_ORIGIN + currentTest.query, "_blank");
+  }
+}
+
+// Set prefs and start test
+SpecialPowers.pushPrefEnv({ set: [
+    ["dom.security.https_first", true],
+    ["security.warn_submit_secure_to_insecure", false]
+  ]}, runTest);
+
+
+</script>
+</body>
+</html>