Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement "Mixed Content" check #543

Merged
merged 1 commit into from Apr 19, 2015

Conversation

Projects
None yet
2 participants
@jugglinmike
Copy link
Contributor

commented Apr 18, 2015

Commit message:

This check ensures that resources embedded within HTML documents are not
requested using a protocol that degrades the security of the original
connection. This avoids "mixed content" warnings in browsers that
enforce consistent protocols, and it precludes the leaking of private
information in browsers that do not.

Resolves gh-542

@@ -4,6 +4,18 @@

module ::Nanoc::Extra
class LinkCollector

@@uri_attrs = {

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

I’d prefer to have this in a constant rather than a class variable (I think Rubocop will complain anyway).

@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 18, 2015

This looks good! I’ll do a more in-depth review soon, but I‘m quite liking it so far.

@ddfreyne ddfreyne added this to the 3.8 milestone Apr 18, 2015

@jugglinmike

This comment has been minimized.

Copy link
Contributor Author

commented Apr 18, 2015

Great, thanks! I'll hold off on moving that class variable till you get a chance to finish.

@@ -4,6 +4,18 @@

module ::Nanoc::Extra
class LinkCollector

@@uri_attrs = {
'a' => :href,

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Does it make sense to disallow linking to a non-secure site from a secure site?

This comment has been minimized.

Copy link
@jugglinmike

jugglinmike Apr 18, 2015

Author Contributor
  1. Prevent insertion of insecure "active content" (such as JavaScript) that could generate misleading content or steal private information
  2. Prevent passive leaking of information--HTTP requests are sent in-the-clear and might leak information about the user's browsing session

Users who navigate using insecure hyperlinks are susceptible to #2, but navigation is performed actively by the user, and it's harder to achieve the task of "saving users from themselves". Plus, the current site's maintainer has no control over the availability of SSL on remote servers.

def external_href?(href)
href =~ %r{^(\/\/|[a-z\-]+:)}
end

def hrefs_in_file(filename)
hrefs_in_file = Set.new
def uris_in_file(filename, tag_names)

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Renaming this method breaks backwards compatibility of the API. Could you change it back, or let hrefs_in_file proxy to the new method?

(I’m not sure whether LinkChecker should’ve been part of the public API, but it’s too late now anyway!)

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Nevermind, just saw that you already did that. Sweet :)

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

(FYI: you can mark classes/methods/modules/… as not part of the public API using @api private.)

end
end

protected

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

I go for private only these days as I find protected to be not so useful.


protected

@@protocol_pattern = /^(\w+):\/\//

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Same comment about the constant vs class variable as below.

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

(I think you might have to use @private to hide it in the YARD documentation.)

@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 18, 2015

The style checks are failing. Apparently, they’re also failing on other parts of the code—I’ll fix it; ignore the style test results for now.

@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 18, 2015

Can you rebase onto master? That should fix the style issues (at least the ones that are not your fault, heh).

@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 18, 2015

Looks good otherwise!

@ddfreyne ddfreyne added status:wip 🔧 and removed to review labels Apr 18, 2015

@jugglinmike jugglinmike force-pushed the jugglinmike:mixed-content-check branch from 613a190 to 8a3b219 Apr 18, 2015

@jugglinmike

This comment has been minimized.

Copy link
Contributor Author

commented Apr 18, 2015

Alrighty, I've rebased and incorporated your feedback in separate commits. I'm happy to squash when you think this is ready

@@ -0,0 +1,31 @@
# encoding: utf-8

PROTOCOL_PATTERN = /^(\w+):\/\//

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Could you move this into the MixedContent class? This way, PROTOCOL_PATTERN won’t be a top-level constant. Constant lookup will still work.

This comment has been minimized.

Copy link
@jugglinmike

jugglinmike Apr 18, 2015

Author Contributor

Ah yeah, much better that way.

@@ -2,6 +2,17 @@

require 'set'

URI_ATTRS = {

This comment has been minimized.

Copy link
@ddfreyne

ddfreyne Apr 18, 2015

Member

Same as above (move into LinkCollector).

@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 18, 2015

Cool! OK to squash. I’ll properly test it out tomorrow and will merge it if it’s OK!

Implement "Mixed Content" check
This check ensures that resources embedded within HTML documents are not
requested using a protocol that degrades the security of the original
connection. This avoids "mixed content" warnings in browsers that
enforce consistent protocols, and it precludes the leaking of private
information in browsers that do not.

@jugglinmike jugglinmike force-pushed the jugglinmike:mixed-content-check branch from c980885 to e2d4feb Apr 18, 2015

@jugglinmike

This comment has been minimized.

Copy link
Contributor Author

commented Apr 18, 2015

Excellent--all squashed

ddfreyne added a commit that referenced this pull request Apr 19, 2015

Merge pull request #543 from jugglinmike/mixed-content-check
Implement "Mixed Content" check

@ddfreyne ddfreyne merged commit 0e7cdad into nanoc:master Apr 19, 2015

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details
@ddfreyne

This comment has been minimized.

Copy link
Member

commented Apr 19, 2015

Thanks!

@jugglinmike

This comment has been minimized.

Copy link
Contributor Author

commented Apr 19, 2015

My pleasure :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.