Prevent usage of web payments API over insecure HTTPS.
Before this patch, the web payments UI would allow user to make payments
easily on pages with invalid HTTPS certificates. Even if the URL bar
showed a red, crossed-out "https", the web payments UI would show a
green "https" with a green lock icon.
This patch fixes the problem by checking the security level of the page.
An HTTPS page that's not EV_SECURE, SECURE, or
SECURE_WITH_POLICY_INSTALLED_CERT is prevented from using any payment
apps.
After this patch, invoking PaymentRequest.show() will always return
NotSupportedError on pages with invalid HTTPS certificates. This is
because Chrome is not providing any payment apps for such pages.
Invoking PaymentRequest.canMakePayment() will always return "false" for
the same reason.
Caveat: Pages with invalid HTTPS certificates are still considered
"SecureContext" in web platform, so throwing "SecurityError" in the
PaymentRequest constructor is not an option.
To test an invalid HTTPS certificate:
1) Visit https://edellroot.badssl.com/input/web-payment.
2) Bypass the interstitial.
3) Tap [Initiate payment] button.
Observe: The web payments UI does not show.
To test a valid HTTPS certificate:
1) Visit https://badssl.com/input/web-payment.
2) Tap [Initiate payment] button.
Observe: The web payments UI shows.
BUG=678764
Review-Url: https://codereview.chromium.org/2815763002
Cr-Commit-Position: refs/heads/master@{#465022}
diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index b74c28b..2c1ccb7 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni
@@ -742,6 +742,7 @@
"java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentAppBridge.java",
"java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentInstrument.java",
"java/src/org/chromium/chrome/browser/payments/ShippingStrings.java",
+ "java/src/org/chromium/chrome/browser/payments/SslValidityChecker.java",
"java/src/org/chromium/chrome/browser/payments/ui/BillingAddressAdapter.java",
"java/src/org/chromium/chrome/browser/payments/ui/Completable.java",
"java/src/org/chromium/chrome/browser/payments/ui/ContactDetailsSection.java",
