forked from google/WebFundamentals
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from johyphenel/origin/material-branch
Updated branch to changes from master google#1875
- Loading branch information
Showing
22 changed files
with
224 additions
and
192 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file removed
BIN
-47 KB
src/content/en/fundamentals/security/avoid-mixed-content/_code/petelepage.jpg
Binary file not shown.
Binary file renamed
BIN
+12.3 KB
...-mixed-content/_code/petelepage-thumb.jpg → ...avoid-mixed-content/_code/puppy-thumb.jpg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added
BIN
+35.8 KB
src/content/en/fundamentals/security/avoid-mixed-content/_code/puppy.jpg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
30 changes: 17 additions & 13 deletions
30
src/content/en/fundamentals/security/avoid-mixed-content/_code/simple-example.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,25 @@ | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <!-- // [TEMPLATE header_full] --> | ||
| <title>Simple mixed content example</title> | ||
| </head> | ||
| <body> | ||
| <h1> | ||
| Simple mixed content example! | ||
| </h1> | ||
| <p> | ||
| View page over: <a href="http://localhost:8888/simple-example.html">HTTP</a> - <a href="https://localhost:4443/simple-example.html">HTTPS</a> | ||
| </p> | ||
| <p> | ||
| This page loads the script simple-example.js using HTTP. This is the simplest case of mixed content. When the simple-example.js file is requested by the browser, an attacker can inject code into the returned content and take control of the entire page. Thankfully, most modern browsers block this type of dangerous content by default and display an error in the JavaScript console. This can be seen when the page is viewed over HTTPS. | ||
| </p> | ||
| <div id="output">Waiting for insecure script to run...</div> | ||
| <!-- // [START snippet1] --> | ||
| <script src="http://localhost:8888/simple-example.js"></script> | ||
| <!-- // [END snippet1] --> | ||
| <div role="main"> | ||
| <h1> | ||
| Simple mixed content example! | ||
| </h1> | ||
| <p> | ||
| View page over: <a href="http://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content/simple-example.html">HTTP</a> - <a href="https://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content/simple-example.html">HTTPS</a> | ||
| </p> | ||
| <p> | ||
| This page loads the script simple-example.js using HTTP. This is the simplest case of mixed content. When the simple-example.js file is requested by the browser, an attacker can inject code into the returned content and take control of the entire page. Thankfully, most modern browsers block this type of dangerous content by default and display an error in the JavaScript console. This can be seen when the page is viewed over HTTPS. | ||
| </p> | ||
| <div id="output">Waiting for insecure script to run...</div> | ||
| <!-- // [START snippet1] --> | ||
| <script src="http://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content/simple-example.js"></script> | ||
| <!-- // [END snippet1] --> | ||
| </div> | ||
| <!-- // [TEMPLATE footer] --> | ||
| </body> | ||
| </html> |
54 changes: 29 additions & 25 deletions
54
src/content/en/fundamentals/security/avoid-mixed-content/_code/xmlhttprequest-example.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,33 +1,37 @@ | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <!-- // [TEMPLATE header_full] --> | ||
| <title>XMLHttpRequest mixed content example</title> | ||
| </head> | ||
| <body> | ||
| <h1> | ||
| XMLHttpRequest mixed content example! | ||
| </h1> | ||
| <p> | ||
| View page over: <a href="http://localhost:8888/xmlhttprequest-example.html">HTTP</a> - <a href="https://localhost:4443/xmlhttprequest-example.html">HTTPS</a> | ||
| </p> | ||
| <p> | ||
| This page constructs an HTTP URL dynamically in JavaScript, the URL is eventually used to load an insecure resource by XMLHttpRequest. When the xmlhttprequest-data.js file is requested by the browser, an attacker can inject code into the returned content and take control of the entire page. Thankfully, most modern browsers block this type of dangerous content by default and display an error in the JavaScript console. This can be seen when the page is viewed over HTTPS. | ||
| </p> | ||
| <div id="output">Waiting for data...</div> | ||
| <!-- // [START snippet1] --> | ||
| <script> | ||
| var rootUrl = 'http://localhost:8888'; | ||
| var resources = { | ||
| jsonData: '/xmlhttprequest-data.js' | ||
| }; | ||
| var request = new XMLHttpRequest(); | ||
| request.addEventListener('load', function() { | ||
| var jsonData = JSON.parse(request.responseText); | ||
| document.getElementById('output').innerHTML += '<br>' + jsonData.data; | ||
| }); | ||
| request.open('GET', rootUrl + resources.jsonData); | ||
| request.send(); | ||
| </script> | ||
| <!-- // [END snippet1] --> | ||
| <div role="main"> | ||
| <h1> | ||
| XMLHttpRequest mixed content example! | ||
| </h1> | ||
| <p> | ||
| View page over: <a href="http://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content/xmlhttprequest-example.html">HTTP</a> - <a href="https://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content/xmlhttprequest-example.html">HTTPS</a> | ||
| </p> | ||
| <p> | ||
| This page constructs an HTTP URL dynamically in JavaScript, the URL is eventually used to load an insecure resource by XMLHttpRequest. When the xmlhttprequest-data.js file is requested by the browser, an attacker can inject code into the returned content and take control of the entire page. Thankfully, most modern browsers block this type of dangerous content by default and display an error in the JavaScript console. This can be seen when the page is viewed over HTTPS. | ||
| </p> | ||
| <div id="output">Waiting for data...</div> | ||
| <!-- // [START snippet1] --> | ||
| <script> | ||
| var rootUrl = 'http://googlesamples.github.io/web-fundamentals/samples/discovery-and-distribution/avoid-mixed-content'; | ||
| var resources = { | ||
| jsonData: '/xmlhttprequest-data.js' | ||
| }; | ||
| var request = new XMLHttpRequest(); | ||
| request.addEventListener('load', function() { | ||
| var jsonData = JSON.parse(request.responseText); | ||
| document.getElementById('output').innerHTML += '<br>' + jsonData.data; | ||
| }); | ||
| request.open('GET', rootUrl + resources.jsonData, true); | ||
| request.send(); | ||
| </script> | ||
| <!-- // [END snippet1] --> | ||
| </div> | ||
| <!-- // [TEMPLATE footer] --> | ||
| </body> | ||
| </html> |
Oops, something went wrong.