https_only_mode_allowlist.h 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. // Copyright 2022 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef COMPONENTS_SECURITY_INTERSTITIALS_CORE_HTTPS_ONLY_MODE_ALLOWLIST_H_
  5. #define COMPONENTS_SECURITY_INTERSTITIALS_CORE_HTTPS_ONLY_MODE_ALLOWLIST_H_
  6. #include <set>
  7. #include "base/memory/raw_ptr.h"
  8. #include "base/time/time.h"
  9. #include "base/values.h"
  10. #include "components/content_settings/core/browser/host_content_settings_map.h"
  11. #include "url/gurl.h"
  12. namespace base {
  13. class Clock;
  14. }
  15. namespace security_interstitials {
  16. // Stores allowlist decisions for HTTPS-Only Mode.
  17. // A user can allowlist a site by clicking through its HTTPS-Only Mode
  18. // interstitial. For default storage partitions (e.g. non-incognito mode), the
  19. // decision is stored in content settings. Otherwise, it's stored in memory.
  20. class HttpsOnlyModeAllowlist {
  21. public:
  22. HttpsOnlyModeAllowlist(HostContentSettingsMap* host_content_settings_map,
  23. base::Clock* clock,
  24. base::TimeDelta expiration_timeout);
  25. HttpsOnlyModeAllowlist(const HttpsOnlyModeAllowlist&) = delete;
  26. HttpsOnlyModeAllowlist& operator=(const HttpsOnlyModeAllowlist&) = delete;
  27. ~HttpsOnlyModeAllowlist();
  28. // Adds host to the list of sites allowed to load over HTTP.
  29. void AllowHttpForHost(const std::string& host, bool is_nondefault_storage);
  30. // Returns true if host is allowed to be loaded over HTTP. If so, we don't
  31. // attempt to upgrade it to HTTPS.
  32. bool IsHttpAllowedForHost(const std::string& host,
  33. bool is_nondefault_storage) const;
  34. // Revokes all HTTP exceptions made by the user for host.
  35. void RevokeUserAllowExceptions(const std::string& host);
  36. // Clears allowlist for the given pattern filter. If the pattern filter is
  37. // empty, clears allowlist for all hosts.
  38. void Clear(
  39. base::Time delete_begin,
  40. base::Time delete_end,
  41. const HostContentSettingsMap::PatternSourcePredicate& pattern_filter);
  42. // Clears the persistent and in-memory allowlist entries. All of in-memory
  43. // entries are removed, but only persistent entries between delete_begin and
  44. // delete_end are removed.
  45. void ClearAllowlist(base::Time delete_begin, base::Time delete_end);
  46. // Sets the test clock.
  47. void SetClockForTesting(base::Clock* clock);
  48. private:
  49. raw_ptr<HostContentSettingsMap> host_content_settings_map_;
  50. raw_ptr<base::Clock> clock_;
  51. base::TimeDelta expiration_timeout_;
  52. // Tracks sites that are allowed to load over HTTP when HTTPS-First Mode is
  53. // enabled, for non-default storage partitions. Allowed hosts are exact
  54. // hostname matches -- subdomains of a host on the allowlist must be
  55. // separately allowlisted.
  56. //
  57. // In most cases, HTTP interstitial decisions are stored in ContentSettings
  58. // and persisted to disk, like cert decisions. Similar to cert decisions, for
  59. // non-default StoragePartitions the decisions should be isolated from normal
  60. // browsing and don't need to be persisted to disk. For these cases, track
  61. // allowlist decisions purely in memory.
  62. std::set<std::string /* host */>
  63. allowed_http_hosts_for_non_default_storage_partitions_;
  64. };
  65. } // namespace security_interstitials
  66. #endif // COMPONENTS_SECURITY_INTERSTITIALS_CORE_HTTPS_ONLY_MODE_ALLOWLIST_H_