Skip to content

Draft PR for introducing a way to ban http #40549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Draft PR for introducing a way to ban http #40549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3a571e
Draft PR for introducing a way to ban http
mehmetf Feb 8, 2020
ce0c322
Have platform specific defaults
mehmetf Feb 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions sdk/lib/_http/http.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1763,6 +1763,14 @@ abstract class HttpClient {
return overrides.findProxyFromEnvironment(url, environment);
}

static bool get isHttpAllowed {
HttpOverrides overrides = HttpOverrides.current;
if (overrides == null) {
return _HttpClient._isHttpAllowedByDefault;
}
return overrides.isHttpAllowed();
}

/**
* Sets the function to be called when a proxy is requesting
* authentication. Information on the proxy in use and the security
Expand Down
12 changes: 12 additions & 0 deletions sdk/lib/_http/http_impl.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2136,6 +2136,7 @@ class _HttpClient implements HttpClient {
Function _authenticate;
Function _authenticateProxy;
Function _findProxy = HttpClient.findProxyFromEnvironment;
bool _isHttpAllowed = HttpClient.isHttpAllowed;
Duration _idleTimeout = const Duration(seconds: 15);
BadCertificateCallback _badCertificateCallback;

Expand All @@ -2151,6 +2152,13 @@ class _HttpClient implements HttpClient {

_HttpClient(this._context);

static bool get _isHttpAllowedByDefault {
if (Platform.isIOS) return true;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe opposite value, i.e. false?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would be a breaking change upstream.

I would be happy to do it but @mit-mit needs to agree.

if (Platform.isAndroid) return true;
// Add any more Platform specific defaults here.
return true;
}

void set idleTimeout(Duration timeout) {
_idleTimeout = timeout;
for (var c in _connectionTargets.values) {
Expand Down Expand Up @@ -2285,6 +2293,10 @@ class _HttpClient implements HttpClient {
}

bool isSecure = (uri.scheme == "https");
if (!_isHttpAllowed && !isSecure) {
throw new ArgumentError("HTTP traffic is not supported in this client. Please use HTTPS.");
}

int port = uri.port;
if (port == 0) {
port =
Expand Down
18 changes: 16 additions & 2 deletions sdk/lib/_http/overrides.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,10 +52,11 @@ abstract class HttpOverrides {
{HttpClient Function(SecurityContext) createHttpClient,
String Function(Uri uri, Map<String, String> environment)
findProxyFromEnvironment,
bool allowHttp,
ZoneSpecification zoneSpecification,
Function onError}) {
HttpOverrides overrides =
new _HttpOverridesScope(createHttpClient, findProxyFromEnvironment);
new _HttpOverridesScope(createHttpClient, findProxyFromEnvironment, allowHttp);
return _asyncRunZoned<R>(body,
zoneValues: {_httpOverridesToken: overrides},
zoneSpecification: zoneSpecification,
Expand Down Expand Up @@ -89,6 +90,11 @@ abstract class HttpOverrides {
String findProxyFromEnvironment(Uri url, Map<String, String> environment) {
return _HttpClient._findProxyFromEnvironment(url, environment);
}

/// Specifies whether HTTP communication in cleartext is allowed.
bool isHttpAllowed() {
return _HttpClient._isHttpAllowedByDefault;
}
}

class _HttpOverridesScope extends HttpOverrides {
Expand All @@ -97,8 +103,16 @@ class _HttpOverridesScope extends HttpOverrides {
final HttpClient Function(SecurityContext) _createHttpClient;
final String Function(Uri uri, Map<String, String> environment)
_findProxyFromEnvironment;
final bool _allowHttp;

_HttpOverridesScope(this._createHttpClient, this._findProxyFromEnvironment, this._allowHttp);

_HttpOverridesScope(this._createHttpClient, this._findProxyFromEnvironment);
@override
bool isHttpAllowed() {
if (_allowHttp != null) return _allowHttp;
if (_previous != null) return _previous.isHttpAllowed();
return super.isHttpAllowed();
}

@override
HttpClient createHttpClient(SecurityContext context) {
Expand Down