Bug 1072859 - Disable Geolocation on non-secure origins. r=jdm
authorMichelangelo De Simone <mdesimone@mozilla.com>
Wed, 08 Mar 2017 16:45:44 -0800
changeset 347082 2d61eb2ffeac
parent 347081 92fcd93e1d50
child 347083 230e0c324669
push id87960
push userkwierso@gmail.com
push dateSat, 11 Mar 2017 07:50:18 +0000
treeherdermozilla-inbound@2d61eb2ffeac [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjdm
bugs1072859
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1072859 - Disable Geolocation on non-secure origins. r=jdm MozReview-Commit-ID: KnHOb0aN4nE
browser/app/profile/firefox.js
browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
dom/geolocation/nsGeolocation.cpp
dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
testing/web-platform/meta/MANIFEST.json
testing/web-platform/meta/geolocation-API/PositionOptions.html.ini
testing/web-platform/meta/geolocation-API/PositionOptions.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.https.html.ini
testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.html.ini
testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.https.html.ini
testing/web-platform/tests/geolocation-API/PositionOptions.html
testing/web-platform/tests/geolocation-API/PositionOptions.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.https.html
testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.html
testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.https.html
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1285,21 +1285,16 @@ pref("geo.provider.ms-windows-location",
 #endif
 
 #if defined(MOZ_WIDGET_GTK) && defined(MOZ_GPSD)
 pref("geo.provider.use_gpsd", true);
 #endif
 
 #endif
 
-// We keep allowing non-HTTPS geo requests on all the release
-// channels, for now.
-// TODO: default to false (or remove altogether) for #1072859.
-pref("geo.security.allowinsecure", true);
-
 // Necko IPC security checks only needed for app isolation for cookies/cache/etc:
 // currently irrelevant for desktop e10s
 pref("network.disable.ipc.security", true);
 
 // CustomizableUI debug logging.
 pref("browser.uiCustomization.debug", false);
 
 // CustomizableUI state of the browser's user interface
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
@@ -1,17 +1,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // This test makes sure that the geolocation prompt does not show a remember
 // control inside the private browsing mode.
 
 add_task(function* test() {
-  const testPageURL = "http://mochi.test:8888/browser/" +
+  const testPageURL = "https://example.com/browser/" +
     "browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt_page.html";
 
   function checkGeolocation(aPrivateMode, aWindow) {
     return Task.spawn(function* () {
       aWindow.gBrowser.selectedTab = aWindow.gBrowser.addTab(testPageURL);
       yield BrowserTestUtils.browserLoaded(aWindow.gBrowser.selectedBrowser);
 
       let notification = aWindow.PopupNotifications.getNotification("geolocation");
--- a/dom/geolocation/nsGeolocation.cpp
+++ b/dom/geolocation/nsGeolocation.cpp
@@ -1167,33 +1167,31 @@ Geolocation::IsAlreadyCleared(nsGeolocat
   }
 
   return false;
 }
 
 bool
 Geolocation::ShouldBlockInsecureRequests() const
 {
-  // TODO: Also remove all the *_SECURE_ORIGIN Telemetry probes before
-  // landing the patch for #1072859. Also default to false.
-  if (Preferences::GetBool(PREF_GEO_SECURITY_ALLOWINSECURE, true)) {
+  if (Preferences::GetBool(PREF_GEO_SECURITY_ALLOWINSECURE, false)) {
     return false;
   }
 
   nsCOMPtr<nsPIDOMWindowInner> win = do_QueryReferent(mOwner);
   if (!win) {
     return false;
   }
 
   nsCOMPtr<nsIDocument> doc = win->GetDoc();
   if (!doc) {
     return false;
   }
 
-  if (!nsGlobalWindow::Cast(win)->IsSecureContext()) {
+  if (!nsGlobalWindow::Cast(win)->IsSecureContextIfOpenerIgnored()) {
     nsContentUtils::ReportToConsole(nsIScriptError::errorFlag,
                                     NS_LITERAL_CSTRING("DOM"), doc,
                                     nsContentUtils::eDOM_PROPERTIES,
                                     "GeolocationInsecureRequestIsForbidden");
     return true;
   }
 
   return false;
--- a/dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
+++ b/dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
@@ -1,15 +1,15 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 "use strict";
 
-const TEST_URI = "http://example.com/" +
+const TEST_URI = "https://example.com/" +
                  "browser/dom/tests/browser/position.html";
 
 add_task(function* testDismissHanger() {
   info("Check that location is not shared when dismissing the geolocation hanger");
 
   let promisePanelShown = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popupshown", true);
   yield BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URI);
   yield promisePanelShown;
--- a/testing/web-platform/meta/MANIFEST.json
+++ b/testing/web-platform/meta/MANIFEST.json
@@ -87994,67 +87994,67 @@
     ]
    ],
    "generic-sensor/idlharness.html": [
     [
      "/generic-sensor/idlharness.html",
      {}
     ]
    ],
-   "geolocation-API/PositionOptions.html": [
-    [
-     "/geolocation-API/PositionOptions.html",
+   "geolocation-API/PositionOptions.https.html": [
+    [
+     "/geolocation-API/PositionOptions.https.html",
      {}
     ]
    ],
    "geolocation-API/clearWatch_TypeError.html": [
     [
      "/geolocation-API/clearWatch_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/getCurrentPosition_IDL.html": [
-    [
-     "/geolocation-API/getCurrentPosition_IDL.html",
+   "geolocation-API/getCurrentPosition_IDL.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_IDL.https.html",
      {}
     ]
    ],
    "geolocation-API/getCurrentPosition_TypeError.html": [
     [
      "/geolocation-API/getCurrentPosition_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/getCurrentPosition_permission_allow.html": [
-    [
-     "/geolocation-API/getCurrentPosition_permission_allow.html",
-     {}
-    ]
-   ],
-   "geolocation-API/getCurrentPosition_permission_deny.html": [
-    [
-     "/geolocation-API/getCurrentPosition_permission_deny.html",
+   "geolocation-API/getCurrentPosition_permission_allow.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_permission_allow.https.html",
+     {}
+    ]
+   ],
+   "geolocation-API/getCurrentPosition_permission_deny.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_permission_deny.https.html",
      {}
     ]
    ],
    "geolocation-API/interfaces.html": [
     [
      "/geolocation-API/interfaces.html",
      {}
     ]
    ],
    "geolocation-API/watchPosition_TypeError.html": [
     [
      "/geolocation-API/watchPosition_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/watchPosition_permission_deny.html": [
-    [
-     "/geolocation-API/watchPosition_permission_deny.html",
+   "geolocation-API/watchPosition_permission_deny.https.html": [
+    [
+     "/geolocation-API/watchPosition_permission_deny.https.html",
      {}
     ]
    ],
    "gyroscope/idlharness.https.html": [
     [
      "/gyroscope/idlharness.https.html",
      {}
     ]
@@ -164795,41 +164795,41 @@
   "generic-sensor/idlharness.html": [
    "0e3f29a3a065a3db2f6e0e77d9c6bbdf47bf5ca8",
    "testharness"
   ],
   "geolocation-API/OWNERS": [
    "0657e9c1d1281428355eb545ba0b4552dc8900ec",
    "support"
   ],
-  "geolocation-API/PositionOptions.html": [
+  "geolocation-API/PositionOptions.https.html": [
    "3ed405ebbe4b6fde9dfa6b3426c52c7025efd84c",
    "testharness"
   ],
   "geolocation-API/clearWatch_TypeError.html": [
    "281cdbc3d81e498514a0cca3e839c33e1b217974",
    "testharness"
   ],
-  "geolocation-API/getCurrentPosition_IDL.html": [
+  "geolocation-API/getCurrentPosition_IDL.https.html": [
    "5c7c8f7406a82140384687bfc66b2ef1d8bdc259",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_TypeError.html": [
    "d00057185b0641895b700d43df91063beb0529ca",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_permission-manual.html": [
    "c4bd25b48591ab5078eafa3439363eaa0a24e7cb",
    "manual"
   ],
   "geolocation-API/getCurrentPosition_permission_allow-manual.html": [
    "e75a1408296aeed55b5edee35d86cb523cce5a4c",
    "manual"
   ],
-  "geolocation-API/getCurrentPosition_permission_allow.html": [
+  "geolocation-API/getCurrentPosition_permission_allow.https.html": [
    "695f80f5a06279b3a0bdd137e6a402da66a5eeee",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_permission_deny-manual.html": [
    "44b2d8846c79ddf7eb8cb3ab76d8899b7e783fad",
    "manual"
   ],
   "geolocation-API/getCurrentPosition_permission_deny.html": [
@@ -164847,17 +164847,17 @@
   "geolocation-API/watchPosition_TypeError.html": [
    "84c57288bdc42dd2c6d97f81e2608a19769272b9",
    "testharness"
   ],
   "geolocation-API/watchPosition_permission-manual.html": [
    "39f9b8442320f67323f55f26a417deb2ae12eacf",
    "manual"
   ],
-  "geolocation-API/watchPosition_permission_deny.html": [
+  "geolocation-API/watchPosition_permission_deny.https.html": [
    "8da70bf5b65ace1e8a26e458d6c011c6183c5501",
    "testharness"
   ],
   "gyroscope/OWNERS": [
    "36770a71443523aa2f91f9958ba24066f0b4dcec",
    "support"
   ],
   "gyroscope/idlharness.https.html": [
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/PositionOptions.html.ini
+++ /dev/null
@@ -1,15 +0,0 @@
-[PositionOptions.html]
-  type: testharness
-  expected: TIMEOUT
-  [Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)]
-    expected: NOTRUN
-
-  [Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)]
-    expected: NOTRUN
-
-  [Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)]
-    expected: NOTRUN
-
-  [Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/PositionOptions.https.html.ini
@@ -0,0 +1,15 @@
+[PositionOptions.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)]
+    expected: NOTRUN
+
+  [Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)]
+    expected: NOTRUN
+
+  [Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)]
+    expected: NOTRUN
+
+  [Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.html.ini
+++ /dev/null
@@ -1,9 +0,0 @@
-[getCurrentPosition_IDL.html]
-  type: testharness
-  expected: TIMEOUT
-  [getCurrentPosition success callback tests]
-    expected: TIMEOUT
-
-  [getCurrentPosition error callback tests]
-    expected: TIMEOUT
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.https.html.ini
@@ -0,0 +1,9 @@
+[getCurrentPosition_IDL.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [getCurrentPosition success callback tests]
+    expected: TIMEOUT
+
+  [getCurrentPosition error callback tests]
+    expected: TIMEOUT
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[getCurrentPosition_permission_allow.html]
-  type: testharness
-  expected: TIMEOUT
-  [User allows access, check that success callback is called or error callback is called with correct code.]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.https.html.ini
@@ -0,0 +1,6 @@
+[getCurrentPosition_permission_allow.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [User allows access, check that success callback is called or error callback is called with correct code.]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[getCurrentPosition_permission_deny.html]
-  type: testharness
-  expected: TIMEOUT
-  [User denies access, check that error callback is called with correct code]
-    expected: TIMEOUT
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.https.html.ini
@@ -0,0 +1,6 @@
+[getCurrentPosition_permission_deny.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [User denies access, check that error callback is called with correct code]
+    expected: TIMEOUT
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[watchPosition_permission_deny.html]
-  type: testharness
-  expected: TIMEOUT
-  [Check that watchPosition returns synchronously before any callbacks are invoked.]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.https.html.ini
@@ -0,0 +1,6 @@
+[watchPosition_permission_deny.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [Check that watchPosition returns synchronously before any callbacks are invoked.]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/PositionOptions.html
+++ /dev/null
@@ -1,113 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset="utf-8">
-<title>Geolocation Test: PositionOptions tests</title>
-<link rel="help" href="http://www.w3.org/TR/geolocation-API/#position_options_interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id="log"></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00123
-test(function() {
-  try {
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: 321});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
-  } catch(e) {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  }
-}, 'Call getCurrentPosition with wrong type for enableHighAccuracy. No exception expected.');
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00124
-test(function() {
-  try {
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: 321});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
-  } catch(e) {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  }
-}, 'Call watchPosition with wrong type for enableHighAccuracy. No exception expected.');
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00086, 00088, 00091 and 00092
-test(function() {
-  var t86 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)'),
-      t88 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)'),
-      t91 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)'),
-      t92 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)');
-
-  try {
-    geo.getCurrentPosition(
-        t86.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t86.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t86.done();
-        }),
-        {timeout: 0, maximumAge: 0}
-    );
-  } catch(e) {
-    t86.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.watchPosition(
-        t88.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t88.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t88.done();
-        }),
-        {timeout: 0, maximumAge: 0}
-    );
-  } catch(e) {
-    t88.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.getCurrentPosition(
-        t91.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t91.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t91.done();
-        }),
-        {timeout:-1, maximumAge: 0}
-    );
-  } catch(e) {
-    t91.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.watchPosition(
-        t92.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-          done();
-        }),
-        t92.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          done();
-        }),
-        {timeout: -1, maximumAge: 0}
-    );
-  } catch(e) {
-    t92.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-}, 'PositionOptions tests');
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/PositionOptions.https.html
@@ -0,0 +1,113 @@
+<!DOCTYPE HTML>
+<meta charset="utf-8">
+<title>Geolocation Test: PositionOptions tests</title>
+<link rel="help" href="http://www.w3.org/TR/geolocation-API/#position_options_interface">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id="log"></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00123
+test(function() {
+  try {
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: 321});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
+  } catch(e) {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  }
+}, 'Call getCurrentPosition with wrong type for enableHighAccuracy. No exception expected.');
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00124
+test(function() {
+  try {
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: 321});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
+  } catch(e) {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  }
+}, 'Call watchPosition with wrong type for enableHighAccuracy. No exception expected.');
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00086, 00088, 00091 and 00092
+test(function() {
+  var t86 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)'),
+      t88 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)'),
+      t91 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)'),
+      t92 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)');
+
+  try {
+    geo.getCurrentPosition(
+        t86.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t86.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t86.done();
+        }),
+        {timeout: 0, maximumAge: 0}
+    );
+  } catch(e) {
+    t86.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.watchPosition(
+        t88.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t88.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t88.done();
+        }),
+        {timeout: 0, maximumAge: 0}
+    );
+  } catch(e) {
+    t88.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.getCurrentPosition(
+        t91.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t91.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t91.done();
+        }),
+        {timeout:-1, maximumAge: 0}
+    );
+  } catch(e) {
+    t91.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.watchPosition(
+        t92.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+          done();
+        }),
+        t92.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          done();
+        }),
+        {timeout: -1, maximumAge: 0}
+    );
+  } catch(e) {
+    t92.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+}, 'PositionOptions tests');
+</script>
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.html
+++ /dev/null
@@ -1,152 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset="utf-8">
-<title>Geolocation Test: getCurrentPosition tests</title>
-<link rel="help" href="http://www.w3.org/TR/geolocation-API/">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id="log"></div>
-<script>
-var geo, success, fail;
-
-setup(function() {
-  geo = navigator.geolocation;
-}, {explicit_done: true});
-
-function successCallback(position)
-{
-  var ii, oldval;
-
-  /*
-    [NoInterfaceObject]
-    interface Position {
-      readonly attribute Coordinates coords;
-      readonly attribute DOMTimeStamp timestamp;
-    };
-  */
-
-  test(function() {
-    assert_equals(position.toString(), "[object Position]",
-        "Position.toString should result in '[object Position]' was: " + position.toString());
-  }, "Position toString");
-
-  test(function() {
-    assert_equals(position.coords.toString(), "[object Coordinates]",
-        "position.coords.toString should result in '[object Coordinates]' was: " + position.coords.toString());
-  }, "Position.coordinates toString");
-
-  test(function() {
-    assert_equals(typeof(position.timestamp), "number",
-        "Position.timestamp should be of type 'number' was: " + typeof(position.timestamp));
-  }, "Position.timestamp is type number");
-
-  /*
-    [NoInterfaceObject]
-    interface Coordinates {
-      readonly attribute double latitude;
-      readonly attribute double longitude;
-      readonly attribute double? altitude;
-      readonly attribute double accuracy;
-      readonly attribute double? altitudeAccuracy;
-      readonly attribute double? heading;
-      readonly attribute double? speed;
-    };
-  */
-
-  for (ii in position.coords) {
-    // these four can be numbers or null
-    if (ii == "altitude" || ii == "altitudeAccuracy" || ii == "heading" || ii == "speed") {
-      test(function() {
-        assert_true(position.coords[ii] === null || typeof(position.coords[ii]) === "number",
-            ii + " must be null or 'number' type, was: " + typeof(position.coords[ii]));
-      }, ii+ " is null or number");
-    } else {
-      test(function() {
-        assert_equals(typeof(position.coords[ii]), "number",
-            ii + " should be type 'number' but typeof returned: " + typeof(position.coords[ii]));
-      }, ii + " is type number");
-    }
-
-    oldval = position.coords[ii];
-    position.coords[ii] = 666;
-
-    test(function() {
-      assert_equals(position.coords[ii], oldval,
-          ii + " should be readonly, wrote: " + position.coords[ii] + " old value was " + oldval);
-    }, ii + " readonly");
-
-  }
-
-  success.done();
-  done();
-}
-
-function BadErrorCallback(error)
-{
-  success.step(function() {
-    assert_unreached("Error callback called in error");
-  });
-  success.done();
-  done();
-}
-
-function BadSuccessCallback(position)
-{
-  fail.step(function() {
-    assert_unreached("Success callback called in error");
-  });
-  fail.done();
-}
-
-function errorCallback(error)
-{
-  test(function() {
-    assert_equals(error.toString(), "[object PositionError]",
-        "PositionError.toString should result in '[object PositionError]' was: " +
-        error.toString());
-  }, "PositionError toString");
-
-  test(function() {
-    assert_equals(error.PERMISSION_DENIED, 1,
-        "PERMISSION_DENIED should be 1 was: " + error.POSITION_DENIED);
-  }, "PERMISSION_DENIED value is 1");
-
-  test(function() {
-    assert_equals(error.POSITION_UNAVAILABLE, 2,
-        "POSITION_UNAVAILABLE should be 2' was: " + error.POSITION_UNAVAILABLE);
-  }, "POSITION_UNAVAILABLE is 2");
-
-  test(function() {
-    assert_equals(error.TIMEOUT, 3,
-        "TIMEOUT should be 3 was: " + error.TIMEOUT);
-  }, "TIMEOUT value is 3");
-
-  fail.done();
-}
-
-success = async_test("getCurrentPosition success callback tests", {timeout:20000});
-
-// with a longer timeout and with the user accepting the position request,
-// this should test the successcallback
-success.step(function() {
-  geo.getCurrentPosition(
-      successCallback,
-      BadErrorCallback,
-      {maximumAge:600000, timeout:10000}
-  );
-});
-
-fail = async_test("getCurrentPosition error callback tests");
-
-// with a timeout of 0 the error callback is hopefully consistently called
-fail.step(function() {
-  geo.getCurrentPosition(
-      BadSuccessCallback,
-      errorCallback,
-      {maximumAge:00, timeout:0}
-  );
-});
-
-</script>
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.https.html
@@ -0,0 +1,152 @@
+<!DOCTYPE HTML>
+<meta charset="utf-8">
+<title>Geolocation Test: getCurrentPosition tests</title>
+<link rel="help" href="http://www.w3.org/TR/geolocation-API/">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id="log"></div>
+<script>
+var geo, success, fail;
+
+setup(function() {
+  geo = navigator.geolocation;
+}, {explicit_done: true});
+
+function successCallback(position)
+{
+  var ii, oldval;
+
+  /*
+    [NoInterfaceObject]
+    interface Position {
+      readonly attribute Coordinates coords;
+      readonly attribute DOMTimeStamp timestamp;
+    };
+  */
+
+  test(function() {
+    assert_equals(position.toString(), "[object Position]",
+        "Position.toString should result in '[object Position]' was: " + position.toString());
+  }, "Position toString");
+
+  test(function() {
+    assert_equals(position.coords.toString(), "[object Coordinates]",
+        "position.coords.toString should result in '[object Coordinates]' was: " + position.coords.toString());
+  }, "Position.coordinates toString");
+
+  test(function() {
+    assert_equals(typeof(position.timestamp), "number",
+        "Position.timestamp should be of type 'number' was: " + typeof(position.timestamp));
+  }, "Position.timestamp is type number");
+
+  /*
+    [NoInterfaceObject]
+    interface Coordinates {
+      readonly attribute double latitude;
+      readonly attribute double longitude;
+      readonly attribute double? altitude;
+      readonly attribute double accuracy;
+      readonly attribute double? altitudeAccuracy;
+      readonly attribute double? heading;
+      readonly attribute double? speed;
+    };
+  */
+
+  for (ii in position.coords) {
+    // these four can be numbers or null
+    if (ii == "altitude" || ii == "altitudeAccuracy" || ii == "heading" || ii == "speed") {
+      test(function() {
+        assert_true(position.coords[ii] === null || typeof(position.coords[ii]) === "number",
+            ii + " must be null or 'number' type, was: " + typeof(position.coords[ii]));
+      }, ii+ " is null or number");
+    } else {
+      test(function() {
+        assert_equals(typeof(position.coords[ii]), "number",
+            ii + " should be type 'number' but typeof returned: " + typeof(position.coords[ii]));
+      }, ii + " is type number");
+    }
+
+    oldval = position.coords[ii];
+    position.coords[ii] = 666;
+
+    test(function() {
+      assert_equals(position.coords[ii], oldval,
+          ii + " should be readonly, wrote: " + position.coords[ii] + " old value was " + oldval);
+    }, ii + " readonly");
+
+  }
+
+  success.done();
+  done();
+}
+
+function BadErrorCallback(error)
+{
+  success.step(function() {
+    assert_unreached("Error callback called in error");
+  });
+  success.done();
+  done();
+}
+
+function BadSuccessCallback(position)
+{
+  fail.step(function() {
+    assert_unreached("Success callback called in error");
+  });
+  fail.done();
+}
+
+function errorCallback(error)
+{
+  test(function() {
+    assert_equals(error.toString(), "[object PositionError]",
+        "PositionError.toString should result in '[object PositionError]' was: " +
+        error.toString());
+  }, "PositionError toString");
+
+  test(function() {
+    assert_equals(error.PERMISSION_DENIED, 1,
+        "PERMISSION_DENIED should be 1 was: " + error.POSITION_DENIED);
+  }, "PERMISSION_DENIED value is 1");
+
+  test(function() {
+    assert_equals(error.POSITION_UNAVAILABLE, 2,
+        "POSITION_UNAVAILABLE should be 2' was: " + error.POSITION_UNAVAILABLE);
+  }, "POSITION_UNAVAILABLE is 2");
+
+  test(function() {
+    assert_equals(error.TIMEOUT, 3,
+        "TIMEOUT should be 3 was: " + error.TIMEOUT);
+  }, "TIMEOUT value is 3");
+
+  fail.done();
+}
+
+success = async_test("getCurrentPosition success callback tests", {timeout:20000});
+
+// with a longer timeout and with the user accepting the position request,
+// this should test the successcallback
+success.step(function() {
+  geo.getCurrentPosition(
+      successCallback,
+      BadErrorCallback,
+      {maximumAge:600000, timeout:10000}
+  );
+});
+
+fail = async_test("getCurrentPosition error callback tests");
+
+// with a timeout of 0 the error callback is hopefully consistently called
+fail.step(function() {
+  geo.getCurrentPosition(
+      BadSuccessCallback,
+      errorCallback,
+      {maximumAge:00, timeout:0}
+  );
+});
+
+</script>
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: getCurrentPosition location access allowed</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#get-current-position'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00002
-var t = async_test('User allows access, check that success callback is called or error callback is called with correct code.'),
-    onSuccess, onError, hasMethodReturned = false;
-
-onSuccess = t.step_func(function(pos) {
-  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
-  test(function() {
-    assert_true(hasMethodReturned);
-  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
-
-  done();
-});
-
-onError = t.step_func(function(err) {
-  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
-  test(function() {
-    assert_true(hasMethodReturned);
-  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
-
-  assert_true(!isUsingPreemptivePermission && err.code === err.POSITION_UNAVAILABLE);
-  done();
-});
-
-try {
-  geo.getCurrentPosition(onSuccess, onError);
-  hasMethodReturned = true;
-} catch(e) {
-  t.step(function() {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  });
-}
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: getCurrentPosition location access allowed</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#get-current-position'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00002
+var t = async_test('User allows access, check that success callback is called or error callback is called with correct code.'),
+    onSuccess, onError, hasMethodReturned = false;
+
+onSuccess = t.step_func(function(pos) {
+  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
+  test(function() {
+    assert_true(hasMethodReturned);
+  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
+
+  done();
+});
+
+onError = t.step_func(function(err) {
+  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
+  test(function() {
+    assert_true(hasMethodReturned);
+  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
+
+  assert_true(!isUsingPreemptivePermission && err.code === err.POSITION_UNAVAILABLE);
+  done();
+});
+
+try {
+  geo.getCurrentPosition(onSuccess, onError);
+  hasMethodReturned = true;
+} catch(e) {
+  t.step(function() {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  });
+}
+</script>
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: getCurrentPosition location access denied</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#privacy_for_uas'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00001
-var t = async_test('User denies access, check that error callback is called with correct code'),
-    onSuccess, onError, hasMethodReturned = false;
-
-t.step(function() {
-  onSuccess = t.step_func(function(pos) {
-    assert_unreached('A success callback was invoked unexpectedly with position ' + positionToString(pos));
-  });
-
-  onError =  t.step_func(function(err) {
-    // http://dev.w3.org/geo/api/test-suite/t.html?00031
-    assert_true(hasMethodReturned, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked');
-    assert_equals(err.code, err.PERMISSION_DENIED,
-        'PossitionError code: ' + err.code, + ', message: ' + err.message);
-    done();
-  });
-
-  geo.getCurrentPosition(onSuccess, onError);
-  hasMethodReturned = true;
-});
-</script>
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: getCurrentPosition location access denied</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#privacy_for_uas'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00001
+var t = async_test('User denies access, check that error callback is called with correct code'),
+    onSuccess, onError, hasMethodReturned = false;
+
+t.step(function() {
+  onSuccess = t.step_func(function(pos) {
+    assert_unreached('A success callback was invoked unexpectedly with position ' + positionToString(pos));
+  });
+
+  onError =  t.step_func(function(err) {
+    // http://dev.w3.org/geo/api/test-suite/t.html?00031
+    assert_true(hasMethodReturned, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked');
+    assert_equals(err.code, err.PERMISSION_DENIED,
+        'PossitionError code: ' + err.code, + ', message: ' + err.message);
+    done();
+  });
+
+  geo.getCurrentPosition(onSuccess, onError);
+  hasMethodReturned = true;
+});
+</script>
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: watchPosition location access denied</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#watch-position'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00062
-var t = async_test('Check that watchPosition returns synchronously before any callbacks are invoked.'),
-    id, checkMethodHasReturned, hasMethodReturned = false;
-
-checkMethodHasReturned = t.step_func(function() {
-  assert_true(hasMethodReturned);
-  done();
-});
-
-try {
-  id = geo.watchPosition(checkMethodHasReturned, checkMethodHasReturned);
-  hasMethodReturned = true;
-} catch(e) {
-  t.step(function() {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  });
-}
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00151
-test(function() {
-  assert_greater_than_equal(id, -2147483648);
-  assert_less_than_equal(id, 2147483647);
-}, 'Check that watchPosition returns a long');
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.https.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: watchPosition location access denied</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#watch-position'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00062
+var t = async_test('Check that watchPosition returns synchronously before any callbacks are invoked.'),
+    id, checkMethodHasReturned, hasMethodReturned = false;
+
+checkMethodHasReturned = t.step_func(function() {
+  assert_true(hasMethodReturned);
+  done();
+});
+
+try {
+  id = geo.watchPosition(checkMethodHasReturned, checkMethodHasReturned);
+  hasMethodReturned = true;
+} catch(e) {
+  t.step(function() {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  });
+}
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00151
+test(function() {
+  assert_greater_than_equal(id, -2147483648);
+  assert_less_than_equal(id, 2147483647);
+}, 'Check that watchPosition returns a long');
+</script>