diff options
author | Florian Bruhin <me@the-compiler.org> | 2020-05-02 18:54:05 +0200 |
---|---|---|
committer | Florian Bruhin <me@the-compiler.org> | 2020-05-02 19:23:12 +0200 |
commit | 19f01bb42d02da539446a52a25bb0c1232b86327 (patch) | |
tree | ba9dff3090481f5a80fde0347a3e3d95511db963 | |
parent | 350835261586037e706371739ebedf2e2d7529c1 (diff) | |
download | qutebrowser-19f01bb42d02da539446a52a25bb0c1232b86327.tar.gz qutebrowser-19f01bb42d02da539446a52a25bb0c1232b86327.zip |
Security: Remember hosts with ignored cert errors for load status
Without this change, we only set a flag when a certificate error occurred.
However, when the same certificate error then happens a second time (e.g.
because of a reload or opening the same URL again), we then colored the URL as
success_https (i.e. green) again.
See #5403
(cherry picked from commit 021ab572a319ca3db5907a33a59774f502b3b975)
-rw-r--r-- | qutebrowser/browser/browsertab.py | 16 | ||||
-rw-r--r-- | qutebrowser/browser/webengine/webenginetab.py | 4 | ||||
-rw-r--r-- | qutebrowser/browser/webkit/webkittab.py | 6 |
3 files changed, 17 insertions, 9 deletions
diff --git a/qutebrowser/browser/browsertab.py b/qutebrowser/browser/browsertab.py index 67fad967c..8bd44002d 100644 --- a/qutebrowser/browser/browsertab.py +++ b/qutebrowser/browser/browsertab.py @@ -864,6 +864,13 @@ class AbstractTab(QWidget): # arg 1: The exit code. renderer_process_terminated = pyqtSignal(TerminationStatus, int) + # Hosts for which a certificate error happened. Shared between all tabs. + # + # Note that we remember hosts here, without scheme/port: + # QtWebEngine/Chromium also only remembers hostnames, and certificates are + # for a given hostname anyways. + _insecure_hosts = set() # type: typing.Set[str] + def __init__(self, *, win_id: int, private: bool, parent: QWidget = None) -> None: self.is_private = private @@ -881,7 +888,6 @@ class AbstractTab(QWidget): self._layout = miscwidgets.WrapperLayout(self) self._widget = None # type: typing.Optional[QWidget] self._progress = 0 - self._has_ssl_errors = False self._load_status = usertypes.LoadStatus.none self._mouse_event_filter = mouse.MouseEventFilter( self, parent=self) @@ -969,7 +975,6 @@ class AbstractTab(QWidget): @pyqtSlot() def _on_load_started(self) -> None: self._progress = 0 - self._has_ssl_errors = False self.data.viewing_source = False self._set_load_status(usertypes.LoadStatus.loading) self.load_started.emit() @@ -1029,9 +1034,12 @@ class AbstractTab(QWidget): Needs to be called by subclasses to trigger a load status update, e.g. as a response to a loadFinished signal. """ - if ok and not self._has_ssl_errors: + if ok: if self.url().scheme() == 'https': - self._set_load_status(usertypes.LoadStatus.success_https) + if self.url().host() in self._insecure_hosts: + self._set_load_status(usertypes.LoadStatus.warn) + else: + self._set_load_status(usertypes.LoadStatus.success_https) else: self._set_load_status(usertypes.LoadStatus.success) elif ok: diff --git a/qutebrowser/browser/webengine/webenginetab.py b/qutebrowser/browser/webengine/webenginetab.py index efaa13014..90d343a9d 100644 --- a/qutebrowser/browser/webengine/webenginetab.py +++ b/qutebrowser/browser/webengine/webenginetab.py @@ -1395,9 +1395,9 @@ class WebEngineTab(browsertab.AbstractTab): @pyqtSlot(certificateerror.CertificateErrorWrapper) def _on_ssl_errors(self, error): - self._has_ssl_errors = True - url = error.url() + self._insecure_hosts.add(url.host()) + log.webview.debug("Certificate error: {}".format(error)) if error.is_overridable(): diff --git a/qutebrowser/browser/webkit/webkittab.py b/qutebrowser/browser/webkit/webkittab.py index 05b6e22a6..6e505a9a9 100644 --- a/qutebrowser/browser/webkit/webkittab.py +++ b/qutebrowser/browser/webkit/webkittab.py @@ -851,9 +851,9 @@ class WebKitTab(browsertab.AbstractTab): if navigation.is_main_frame: self.settings.update_for_url(navigation.url) - @pyqtSlot() - def _on_ssl_errors(self): - self._has_ssl_errors = True + @pyqtSlot('QNetworkReply*') + def _on_ssl_errors(self, reply): + self._insecure_hosts.add(reply.url().host()) def _connect_signals(self): view = self._widget |