text: /* This Source Code Form is subject to the terms of the Mozilla Public
   * License, v. 2.0. If a copy of the MPL was not distributed with this
   * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  
  this.EXPORTED_SYMBOLS = [ "InsecurePasswordUtils" ];
  
  const Ci = Components.interfaces;
  const Cu = Components.utils;
  const Cc = Components.classes;
  
  Cu.import("resource://gre/modules/Services.jsm");
  Cu.import("resource://gre/modules/XPCOMUtils.jsm");
  
  XPCOMUtils.defineLazyModuleGetter(this, "devtools",
                                    "resource://gre/modules/devtools/Loader.jsm");
  
  Object.defineProperty(this, "WebConsoleUtils", {
    get: function() {
      return devtools.require("devtools/toolkit/webconsole/utils").Utils;
    },
    configurable: true,
    enumerable: true
  });
  
  const STRINGS_URI = "chrome://global/locale/security/security.properties";
  let l10n = new WebConsoleUtils.l10n(STRINGS_URI);
  
  this.InsecurePasswordUtils = {
  
    _sendWebConsoleMessage : function (messageTag, domDoc) {
      /*
       * All web console messages are warnings for now so I decided to set the
       * flag here and save a bit of the flag creation in the callers.
       * It's easy to expose this later if needed
       */
  
      let  windowId = WebConsoleUtils.getInnerWindowId(domDoc.defaultView);
      let category = "Insecure Password Field";
      let flag = Ci.nsIScriptError.warningFlag;
      let message = l10n.getStr(messageTag);
      let consoleMsg = Cc["@mozilla.org/scripterror;1"]
        .createInstance(Ci.nsIScriptError);
  
      consoleMsg.initWithWindowID(
        message, "", 0, 0, 0, flag, category, windowId);
  
      Services.console.logMessage(consoleMsg);
    },
  
    /*
     * Checks whether the passed uri is secure
     * Check Protocol Flags to determine if scheme is secure:
     * URI_DOES_NOT_RETURN_DATA - e.g.
     *   "mailto"
     * URI_IS_LOCAL_RESOURCE - e.g.
     *   "data",
     *   "resource",
     *   "moz-icon"
     * URI_INHERITS_SECURITY_CONTEXT - e.g.
     *   "javascript"
     * URI_SAFE_TO_LOAD_IN_SECURE_CONTEXT - e.g.
     *   "https",
     *   "moz-safe-about"
     *
     *   The use of this logic comes directly from nsMixedContentBlocker.cpp
     *   At the time it was decided to include these protocols since a secure
     *   uri for mixed content blocker means that the resource can't be
     *   easily tampered with because 1) it is sent over an encrypted channel or
     *   2) it is a local resource that never hits the network
     *   or 3) it is a request sent without any response that could alter
     *   the behavior of the page. It was decided to include the same logic
     *   here both to be consistent with MCB and to make sure we cover all
     *   "safe" protocols. Eventually, the code here and the code in MCB
     *   will be moved to a common location that will be referenced from
     *   both places. Look at
     *   https://bugzilla.mozilla.org/show_bug.cgi?id=899099 for more info.
     */
    _checkIfURIisSecure : function(uri) {
      let isSafe = false;
      let netutil = Cc["@mozilla.org/network/util;1"].getService(Ci.nsINetUtil);
      let ph = Ci.nsIProtocolHandler;
  
      if (netutil.URIChainHasFlags(uri, ph.URI_IS_LOCAL_RESOURCE) ||
          netutil.URIChainHasFlags(uri, ph.URI_DOES_NOT_RETURN_DATA) ||
          netutil.URIChainHasFlags(uri, ph.URI_INHERITS_SECURITY_CONTEXT) ||
          netutil.URIChainHasFlags(uri, ph.URI_SAFE_TO_LOAD_IN_SECURE_CONTEXT)) {
  
        isSafe = true;
      }
  
      return isSafe;
    },
  
    /*
     * Checks whether the passed nested document is insecure
     * or is inside an insecure parent document.
     *
     * We check the chain of frame ancestors all the way until the top document
     * because MITM attackers could replace https:// iframes if they are nested inside
     * http:// documents with their own content, thus creating a security risk
     * and potentially stealing user data. Under such scenario, a user might not
     * get a Mixed Content Blocker message, if the main document is served over HTTP
     * and framing an HTTPS page as it would under the reverse scenario (http
     * inside https).
     */
    _checkForInsecureNestedDocuments : function(domDoc) {
      let uri = domDoc.documentURIObject;
      if (domDoc.defaultView == domDoc.defaultView.parent) {
        // We are at the top, nothing to check here
        return false;
      }
      if (!this._checkIfURIisSecure(uri)) {
        // We are insecure
        return true;
      }
      // I am secure, but check my parent
      return this._checkForInsecureNestedDocuments(domDoc.defaultView.parent.document);
    },
  
  
    /*
     * Checks if there are insecure password fields present on the form's document
     * i.e. passwords inside forms with http action, inside iframes with http src,
     * or on insecure web pages. If insecure password fields are present,
     * a log message is sent to the web console to warn developers.
     */
    checkForInsecurePasswords : function (aForm) {
      var domDoc = aForm.ownerDocument;
      let pageURI = domDoc.defaultView.top.document.documentURIObject;
      let isSafePage = this._checkIfURIisSecure(pageURI);
  
      if (!isSafePage) {
        this._sendWebConsoleMessage("InsecurePasswordsPresentOnPage", domDoc);
      }
  
      // Check if we are on an iframe with insecure src, or inside another
      // insecure iframe or document.
      if (this._checkForInsecureNestedDocuments(domDoc)) {
        this._sendWebConsoleMessage("InsecurePasswordsPresentOnIframe", domDoc);
      }
  
      if (aForm.action.match(/^http:\/\//)) {
        this._sendWebConsoleMessage("InsecureFormActionPasswordsPresent", domDoc);
      }
    },
  };
  