Bug 1072859 - Disable Geolocation on non-secure origins. r?jdm draft
authorMichelangelo De Simone <mdesimone@mozilla.com>
Mon, 06 Mar 2017 14:10:13 -0800
changeset 495567 bd5fe830e8d404191addd383457b97f5a611c3cc
parent 495323 800ba54a4bd52628833c4db005ddd182586666c4
child 548410 1926305260b77d75c69bc6d82ac847f388f1c741
push id48367
push userbmo:mdesimone@mozilla.com
push dateThu, 09 Mar 2017 00:32:27 +0000
reviewersjdm
bugs1072859
milestone55.0a1
Bug 1072859 - Disable Geolocation on non-secure origins. r?jdm MozReview-Commit-ID: KnHOb0aN4nE
browser/app/profile/firefox.js
browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
devtools/client/responsive.html/test/browser/browser_permission_doorhanger.js
dom/geolocation/nsGeolocation.cpp
dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
testing/web-platform/meta/MANIFEST.json
testing/web-platform/meta/geolocation-API/PositionOptions.html.ini
testing/web-platform/meta/geolocation-API/PositionOptions.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.https.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.html.ini
testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.https.html.ini
testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.html.ini
testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.https.html.ini
testing/web-platform/tests/geolocation-API/PositionOptions.html
testing/web-platform/tests/geolocation-API/PositionOptions.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.https.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.html
testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.https.html
testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.html
testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.https.html
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1284,21 +1284,16 @@ pref("geo.provider.ms-windows-location",
 #endif
 
 #if defined(MOZ_WIDGET_GTK) && defined(MOZ_GPSD)
 pref("geo.provider.use_gpsd", true);
 #endif
 
 #endif
 
-// We keep allowing non-HTTPS geo requests on all the release
-// channels, for now.
-// TODO: default to false (or remove altogether) for #1072859.
-pref("geo.security.allowinsecure", true);
-
 // Necko IPC security checks only needed for app isolation for cookies/cache/etc:
 // currently irrelevant for desktop e10s
 pref("network.disable.ipc.security", true);
 
 // CustomizableUI debug logging.
 pref("browser.uiCustomization.debug", false);
 
 // CustomizableUI state of the browser's user interface
--- a/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
+++ b/browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt.js
@@ -1,17 +1,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // This test makes sure that the geolocation prompt does not show a remember
 // control inside the private browsing mode.
 
 add_task(function* test() {
-  const testPageURL = "http://mochi.test:8888/browser/" +
+  const testPageURL = "https://example.com/browser/" +
     "browser/components/privatebrowsing/test/browser/browser_privatebrowsing_geoprompt_page.html";
 
   function checkGeolocation(aPrivateMode, aWindow) {
     return Task.spawn(function* () {
       aWindow.gBrowser.selectedTab = aWindow.gBrowser.addTab(testPageURL);
       yield BrowserTestUtils.browserLoaded(aWindow.gBrowser.selectedBrowser);
 
       let notification = aWindow.PopupNotifications.getNotification("geolocation");
--- a/devtools/client/responsive.html/test/browser/browser_permission_doorhanger.js
+++ b/devtools/client/responsive.html/test/browser/browser_permission_doorhanger.js
@@ -1,16 +1,17 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 // Test that permission popups asking for user approval still appear in RDM
 const DUMMY_URL = "http://example.com/";
 const TEST_URL = `${URL_ROOT}geolocation.html`;
+const TEST_SURL = TEST_URL.replace('http://example.com', 'https://example.com');
 
 function waitForGeolocationPrompt(win, browser) {
   return new Promise(resolve => {
     win.PopupNotifications.panel.addEventListener("popupshown", function popupShown() {
       let notification = win.PopupNotifications.getNotification("geolocation", browser);
       if (notification) {
         win.PopupNotifications.panel.removeEventListener("popupshown", popupShown);
         resolve();
@@ -23,30 +24,30 @@ add_task(function* () {
   let tab = yield addTab(DUMMY_URL);
   let browser = tab.linkedBrowser;
   let win = browser.ownerGlobal;
 
   let waitPromptPromise = waitForGeolocationPrompt(win, browser);
 
   // Checks if a geolocation permission doorhanger appears when openning a page
   // requesting geolocation
-  yield load(browser, TEST_URL);
+  yield load(browser, TEST_SURL);
   yield waitPromptPromise;
 
   ok(true, "Permission doorhanger appeared without RDM enabled");
 
   // Lets switch back to the dummy website and enable RDM
   yield load(browser, DUMMY_URL);
   let { ui } = yield openRDM(tab);
   let newBrowser = ui.getViewportBrowser();
 
   waitPromptPromise = waitForGeolocationPrompt(win, newBrowser);
 
   // Checks if the doorhanger appeared again when reloading the geolocation
   // page inside RDM
-  yield load(browser, TEST_URL);
+  yield load(browser, TEST_SURL);
   yield waitPromptPromise;
 
   ok(true, "Permission doorhanger appeared inside RDM");
 
   yield closeRDM(tab);
   yield removeTab(tab);
 });
--- a/dom/geolocation/nsGeolocation.cpp
+++ b/dom/geolocation/nsGeolocation.cpp
@@ -1167,33 +1167,31 @@ Geolocation::IsAlreadyCleared(nsGeolocat
   }
 
   return false;
 }
 
 bool
 Geolocation::ShouldBlockInsecureRequests() const
 {
-  // TODO: Also remove all the *_SECURE_ORIGIN Telemetry probes before
-  // landing the patch for #1072859. Also default to false.
-  if (Preferences::GetBool(PREF_GEO_SECURITY_ALLOWINSECURE, true)) {
+  if (Preferences::GetBool(PREF_GEO_SECURITY_ALLOWINSECURE, false)) {
     return false;
   }
 
   nsCOMPtr<nsPIDOMWindowInner> win = do_QueryReferent(mOwner);
   if (!win) {
     return false;
   }
 
   nsCOMPtr<nsIDocument> doc = win->GetDoc();
   if (!doc) {
     return false;
   }
 
-  if (!nsGlobalWindow::Cast(win)->IsSecureContext()) {
+  if (!nsGlobalWindow::Cast(win)->IsSecureContextIfOpenerIgnored()) {
     nsContentUtils::ReportToConsole(nsIScriptError::errorFlag,
                                     NS_LITERAL_CSTRING("DOM"), doc,
                                     nsContentUtils::eDOM_PROPERTIES,
                                     "GeolocationInsecureRequestIsForbidden");
     return true;
   }
 
   return false;
--- a/dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
+++ b/dom/tests/browser/browser_bug1008941_dismissGeolocationHanger.js
@@ -1,15 +1,15 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 "use strict";
 
-const TEST_URI = "http://example.com/" +
+const TEST_URI = "https://example.com/" +
                  "browser/dom/tests/browser/position.html";
 
 add_task(function* testDismissHanger() {
   info("Check that location is not shared when dismissing the geolocation hanger");
 
   let promisePanelShown = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popupshown", true);
   yield BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URI);
   yield promisePanelShown;
--- a/testing/web-platform/meta/MANIFEST.json
+++ b/testing/web-platform/meta/MANIFEST.json
@@ -87989,67 +87989,67 @@
     ]
    ],
    "generic-sensor/idlharness.html": [
     [
      "/generic-sensor/idlharness.html",
      {}
     ]
    ],
-   "geolocation-API/PositionOptions.html": [
-    [
-     "/geolocation-API/PositionOptions.html",
+   "geolocation-API/PositionOptions.https.html": [
+    [
+     "/geolocation-API/PositionOptions.https.html",
      {}
     ]
    ],
    "geolocation-API/clearWatch_TypeError.html": [
     [
      "/geolocation-API/clearWatch_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/getCurrentPosition_IDL.html": [
-    [
-     "/geolocation-API/getCurrentPosition_IDL.html",
+   "geolocation-API/getCurrentPosition_IDL.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_IDL.https.html",
      {}
     ]
    ],
    "geolocation-API/getCurrentPosition_TypeError.html": [
     [
      "/geolocation-API/getCurrentPosition_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/getCurrentPosition_permission_allow.html": [
-    [
-     "/geolocation-API/getCurrentPosition_permission_allow.html",
-     {}
-    ]
-   ],
-   "geolocation-API/getCurrentPosition_permission_deny.html": [
-    [
-     "/geolocation-API/getCurrentPosition_permission_deny.html",
+   "geolocation-API/getCurrentPosition_permission_allow.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_permission_allow.https.html",
+     {}
+    ]
+   ],
+   "geolocation-API/getCurrentPosition_permission_deny.https.html": [
+    [
+     "/geolocation-API/getCurrentPosition_permission_deny.https.html",
      {}
     ]
    ],
    "geolocation-API/interfaces.html": [
     [
      "/geolocation-API/interfaces.html",
      {}
     ]
    ],
    "geolocation-API/watchPosition_TypeError.html": [
     [
      "/geolocation-API/watchPosition_TypeError.html",
      {}
     ]
    ],
-   "geolocation-API/watchPosition_permission_deny.html": [
-    [
-     "/geolocation-API/watchPosition_permission_deny.html",
+   "geolocation-API/watchPosition_permission_deny.https.html": [
+    [
+     "/geolocation-API/watchPosition_permission_deny.https.html",
      {}
     ]
    ],
    "gyroscope/idlharness.https.html": [
     [
      "/gyroscope/idlharness.https.html",
      {}
     ]
@@ -164778,41 +164778,41 @@
   "generic-sensor/idlharness.html": [
    "0e3f29a3a065a3db2f6e0e77d9c6bbdf47bf5ca8",
    "testharness"
   ],
   "geolocation-API/OWNERS": [
    "0657e9c1d1281428355eb545ba0b4552dc8900ec",
    "support"
   ],
-  "geolocation-API/PositionOptions.html": [
+  "geolocation-API/PositionOptions.https.html": [
    "3ed405ebbe4b6fde9dfa6b3426c52c7025efd84c",
    "testharness"
   ],
   "geolocation-API/clearWatch_TypeError.html": [
    "281cdbc3d81e498514a0cca3e839c33e1b217974",
    "testharness"
   ],
-  "geolocation-API/getCurrentPosition_IDL.html": [
+  "geolocation-API/getCurrentPosition_IDL.https.html": [
    "5c7c8f7406a82140384687bfc66b2ef1d8bdc259",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_TypeError.html": [
    "d00057185b0641895b700d43df91063beb0529ca",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_permission-manual.html": [
    "c4bd25b48591ab5078eafa3439363eaa0a24e7cb",
    "manual"
   ],
   "geolocation-API/getCurrentPosition_permission_allow-manual.html": [
    "e75a1408296aeed55b5edee35d86cb523cce5a4c",
    "manual"
   ],
-  "geolocation-API/getCurrentPosition_permission_allow.html": [
+  "geolocation-API/getCurrentPosition_permission_allow.https.html": [
    "695f80f5a06279b3a0bdd137e6a402da66a5eeee",
    "testharness"
   ],
   "geolocation-API/getCurrentPosition_permission_deny-manual.html": [
    "44b2d8846c79ddf7eb8cb3ab76d8899b7e783fad",
    "manual"
   ],
   "geolocation-API/getCurrentPosition_permission_deny.html": [
@@ -164830,17 +164830,17 @@
   "geolocation-API/watchPosition_TypeError.html": [
    "84c57288bdc42dd2c6d97f81e2608a19769272b9",
    "testharness"
   ],
   "geolocation-API/watchPosition_permission-manual.html": [
    "39f9b8442320f67323f55f26a417deb2ae12eacf",
    "manual"
   ],
-  "geolocation-API/watchPosition_permission_deny.html": [
+  "geolocation-API/watchPosition_permission_deny.https.html": [
    "8da70bf5b65ace1e8a26e458d6c011c6183c5501",
    "testharness"
   ],
   "gyroscope/OWNERS": [
    "36770a71443523aa2f91f9958ba24066f0b4dcec",
    "support"
   ],
   "gyroscope/idlharness.https.html": [
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/PositionOptions.html.ini
+++ /dev/null
@@ -1,15 +0,0 @@
-[PositionOptions.html]
-  type: testharness
-  expected: TIMEOUT
-  [Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)]
-    expected: NOTRUN
-
-  [Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)]
-    expected: NOTRUN
-
-  [Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)]
-    expected: NOTRUN
-
-  [Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/PositionOptions.https.html.ini
@@ -0,0 +1,15 @@
+[PositionOptions.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)]
+    expected: NOTRUN
+
+  [Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)]
+    expected: NOTRUN
+
+  [Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)]
+    expected: NOTRUN
+
+  [Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.html.ini
+++ /dev/null
@@ -1,9 +0,0 @@
-[getCurrentPosition_IDL.html]
-  type: testharness
-  expected: TIMEOUT
-  [getCurrentPosition success callback tests]
-    expected: TIMEOUT
-
-  [getCurrentPosition error callback tests]
-    expected: TIMEOUT
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_IDL.https.html.ini
@@ -0,0 +1,9 @@
+[getCurrentPosition_IDL.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [getCurrentPosition success callback tests]
+    expected: TIMEOUT
+
+  [getCurrentPosition error callback tests]
+    expected: TIMEOUT
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[getCurrentPosition_permission_allow.html]
-  type: testharness
-  expected: TIMEOUT
-  [User allows access, check that success callback is called or error callback is called with correct code.]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_allow.https.html.ini
@@ -0,0 +1,6 @@
+[getCurrentPosition_permission_allow.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [User allows access, check that success callback is called or error callback is called with correct code.]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[getCurrentPosition_permission_deny.html]
-  type: testharness
-  expected: TIMEOUT
-  [User denies access, check that error callback is called with correct code]
-    expected: TIMEOUT
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/getCurrentPosition_permission_deny.https.html.ini
@@ -0,0 +1,6 @@
+[getCurrentPosition_permission_deny.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [User denies access, check that error callback is called with correct code]
+    expected: TIMEOUT
+
deleted file mode 100644
--- a/testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[watchPosition_permission_deny.html]
-  type: testharness
-  expected: TIMEOUT
-  [Check that watchPosition returns synchronously before any callbacks are invoked.]
-    expected: NOTRUN
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/meta/geolocation-API/watchPosition_permission_deny.https.html.ini
@@ -0,0 +1,6 @@
+[watchPosition_permission_deny.https.html]
+  type: testharness
+  expected: TIMEOUT
+  [Check that watchPosition returns synchronously before any callbacks are invoked.]
+    expected: NOTRUN
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/PositionOptions.html
+++ /dev/null
@@ -1,113 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset="utf-8">
-<title>Geolocation Test: PositionOptions tests</title>
-<link rel="help" href="http://www.w3.org/TR/geolocation-API/#position_options_interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id="log"></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00123
-test(function() {
-  try {
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: 321});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
-    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
-  } catch(e) {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  }
-}, 'Call getCurrentPosition with wrong type for enableHighAccuracy. No exception expected.');
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00124
-test(function() {
-  try {
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: 321});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
-    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
-  } catch(e) {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  }
-}, 'Call watchPosition with wrong type for enableHighAccuracy. No exception expected.');
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00086, 00088, 00091 and 00092
-test(function() {
-  var t86 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)'),
-      t88 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)'),
-      t91 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)'),
-      t92 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)');
-
-  try {
-    geo.getCurrentPosition(
-        t86.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t86.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t86.done();
-        }),
-        {timeout: 0, maximumAge: 0}
-    );
-  } catch(e) {
-    t86.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.watchPosition(
-        t88.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t88.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t88.done();
-        }),
-        {timeout: 0, maximumAge: 0}
-    );
-  } catch(e) {
-    t88.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.getCurrentPosition(
-        t91.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-        }),
-        t91.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          t91.done();
-        }),
-        {timeout:-1, maximumAge: 0}
-    );
-  } catch(e) {
-    t91.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-
-  try {
-    geo.watchPosition(
-        t92.step_func(function(pos) {
-          assert_unreached('A success callback was invoked unexpectedly');
-          done();
-        }),
-        t92.step_func(function(err) {
-          assert_equals(err.code, err.TIMEOUT);
-          done();
-        }),
-        {timeout: -1, maximumAge: 0}
-    );
-  } catch(e) {
-    t92.step(function() {
-      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-    });
-  }
-}, 'PositionOptions tests');
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/PositionOptions.https.html
@@ -0,0 +1,113 @@
+<!DOCTYPE HTML>
+<meta charset="utf-8">
+<title>Geolocation Test: PositionOptions tests</title>
+<link rel="help" href="http://www.w3.org/TR/geolocation-API/#position_options_interface">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id="log"></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00123
+test(function() {
+  try {
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: 321});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
+    geo.getCurrentPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
+  } catch(e) {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  }
+}, 'Call getCurrentPosition with wrong type for enableHighAccuracy. No exception expected.');
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00124
+test(function() {
+  try {
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: "boom"});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: 321});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: -Infinity});
+    geo.watchPosition(dummyFunction, null, {enableHighAccuracy: {foo: 5}});
+  } catch(e) {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  }
+}, 'Call watchPosition with wrong type for enableHighAccuracy. No exception expected.');
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00086, 00088, 00091 and 00092
+test(function() {
+  var t86 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (getCurrentPosition)'),
+      t88 = async_test('Set timeout and maximumAge to 0, check that timeout error raised (watchPosition)'),
+      t91 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (getCurrentLocation)'),
+      t92 = async_test('Check that a negative timeout value is equivalent to a 0 timeout value (watchPosition)');
+
+  try {
+    geo.getCurrentPosition(
+        t86.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t86.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t86.done();
+        }),
+        {timeout: 0, maximumAge: 0}
+    );
+  } catch(e) {
+    t86.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.watchPosition(
+        t88.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t88.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t88.done();
+        }),
+        {timeout: 0, maximumAge: 0}
+    );
+  } catch(e) {
+    t88.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.getCurrentPosition(
+        t91.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+        }),
+        t91.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          t91.done();
+        }),
+        {timeout:-1, maximumAge: 0}
+    );
+  } catch(e) {
+    t91.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+
+  try {
+    geo.watchPosition(
+        t92.step_func(function(pos) {
+          assert_unreached('A success callback was invoked unexpectedly');
+          done();
+        }),
+        t92.step_func(function(err) {
+          assert_equals(err.code, err.TIMEOUT);
+          done();
+        }),
+        {timeout: -1, maximumAge: 0}
+    );
+  } catch(e) {
+    t92.step(function() {
+      assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+    });
+  }
+}, 'PositionOptions tests');
+</script>
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.html
+++ /dev/null
@@ -1,152 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset="utf-8">
-<title>Geolocation Test: getCurrentPosition tests</title>
-<link rel="help" href="http://www.w3.org/TR/geolocation-API/">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id="log"></div>
-<script>
-var geo, success, fail;
-
-setup(function() {
-  geo = navigator.geolocation;
-}, {explicit_done: true});
-
-function successCallback(position)
-{
-  var ii, oldval;
-
-  /*
-    [NoInterfaceObject]
-    interface Position {
-      readonly attribute Coordinates coords;
-      readonly attribute DOMTimeStamp timestamp;
-    };
-  */
-
-  test(function() {
-    assert_equals(position.toString(), "[object Position]",
-        "Position.toString should result in '[object Position]' was: " + position.toString());
-  }, "Position toString");
-
-  test(function() {
-    assert_equals(position.coords.toString(), "[object Coordinates]",
-        "position.coords.toString should result in '[object Coordinates]' was: " + position.coords.toString());
-  }, "Position.coordinates toString");
-
-  test(function() {
-    assert_equals(typeof(position.timestamp), "number",
-        "Position.timestamp should be of type 'number' was: " + typeof(position.timestamp));
-  }, "Position.timestamp is type number");
-
-  /*
-    [NoInterfaceObject]
-    interface Coordinates {
-      readonly attribute double latitude;
-      readonly attribute double longitude;
-      readonly attribute double? altitude;
-      readonly attribute double accuracy;
-      readonly attribute double? altitudeAccuracy;
-      readonly attribute double? heading;
-      readonly attribute double? speed;
-    };
-  */
-
-  for (ii in position.coords) {
-    // these four can be numbers or null
-    if (ii == "altitude" || ii == "altitudeAccuracy" || ii == "heading" || ii == "speed") {
-      test(function() {
-        assert_true(position.coords[ii] === null || typeof(position.coords[ii]) === "number",
-            ii + " must be null or 'number' type, was: " + typeof(position.coords[ii]));
-      }, ii+ " is null or number");
-    } else {
-      test(function() {
-        assert_equals(typeof(position.coords[ii]), "number",
-            ii + " should be type 'number' but typeof returned: " + typeof(position.coords[ii]));
-      }, ii + " is type number");
-    }
-
-    oldval = position.coords[ii];
-    position.coords[ii] = 666;
-
-    test(function() {
-      assert_equals(position.coords[ii], oldval,
-          ii + " should be readonly, wrote: " + position.coords[ii] + " old value was " + oldval);
-    }, ii + " readonly");
-
-  }
-
-  success.done();
-  done();
-}
-
-function BadErrorCallback(error)
-{
-  success.step(function() {
-    assert_unreached("Error callback called in error");
-  });
-  success.done();
-  done();
-}
-
-function BadSuccessCallback(position)
-{
-  fail.step(function() {
-    assert_unreached("Success callback called in error");
-  });
-  fail.done();
-}
-
-function errorCallback(error)
-{
-  test(function() {
-    assert_equals(error.toString(), "[object PositionError]",
-        "PositionError.toString should result in '[object PositionError]' was: " +
-        error.toString());
-  }, "PositionError toString");
-
-  test(function() {
-    assert_equals(error.PERMISSION_DENIED, 1,
-        "PERMISSION_DENIED should be 1 was: " + error.POSITION_DENIED);
-  }, "PERMISSION_DENIED value is 1");
-
-  test(function() {
-    assert_equals(error.POSITION_UNAVAILABLE, 2,
-        "POSITION_UNAVAILABLE should be 2' was: " + error.POSITION_UNAVAILABLE);
-  }, "POSITION_UNAVAILABLE is 2");
-
-  test(function() {
-    assert_equals(error.TIMEOUT, 3,
-        "TIMEOUT should be 3 was: " + error.TIMEOUT);
-  }, "TIMEOUT value is 3");
-
-  fail.done();
-}
-
-success = async_test("getCurrentPosition success callback tests", {timeout:20000});
-
-// with a longer timeout and with the user accepting the position request,
-// this should test the successcallback
-success.step(function() {
-  geo.getCurrentPosition(
-      successCallback,
-      BadErrorCallback,
-      {maximumAge:600000, timeout:10000}
-  );
-});
-
-fail = async_test("getCurrentPosition error callback tests");
-
-// with a timeout of 0 the error callback is hopefully consistently called
-fail.step(function() {
-  geo.getCurrentPosition(
-      BadSuccessCallback,
-      errorCallback,
-      {maximumAge:00, timeout:0}
-  );
-});
-
-</script>
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_IDL.https.html
@@ -0,0 +1,152 @@
+<!DOCTYPE HTML>
+<meta charset="utf-8">
+<title>Geolocation Test: getCurrentPosition tests</title>
+<link rel="help" href="http://www.w3.org/TR/geolocation-API/">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id="log"></div>
+<script>
+var geo, success, fail;
+
+setup(function() {
+  geo = navigator.geolocation;
+}, {explicit_done: true});
+
+function successCallback(position)
+{
+  var ii, oldval;
+
+  /*
+    [NoInterfaceObject]
+    interface Position {
+      readonly attribute Coordinates coords;
+      readonly attribute DOMTimeStamp timestamp;
+    };
+  */
+
+  test(function() {
+    assert_equals(position.toString(), "[object Position]",
+        "Position.toString should result in '[object Position]' was: " + position.toString());
+  }, "Position toString");
+
+  test(function() {
+    assert_equals(position.coords.toString(), "[object Coordinates]",
+        "position.coords.toString should result in '[object Coordinates]' was: " + position.coords.toString());
+  }, "Position.coordinates toString");
+
+  test(function() {
+    assert_equals(typeof(position.timestamp), "number",
+        "Position.timestamp should be of type 'number' was: " + typeof(position.timestamp));
+  }, "Position.timestamp is type number");
+
+  /*
+    [NoInterfaceObject]
+    interface Coordinates {
+      readonly attribute double latitude;
+      readonly attribute double longitude;
+      readonly attribute double? altitude;
+      readonly attribute double accuracy;
+      readonly attribute double? altitudeAccuracy;
+      readonly attribute double? heading;
+      readonly attribute double? speed;
+    };
+  */
+
+  for (ii in position.coords) {
+    // these four can be numbers or null
+    if (ii == "altitude" || ii == "altitudeAccuracy" || ii == "heading" || ii == "speed") {
+      test(function() {
+        assert_true(position.coords[ii] === null || typeof(position.coords[ii]) === "number",
+            ii + " must be null or 'number' type, was: " + typeof(position.coords[ii]));
+      }, ii+ " is null or number");
+    } else {
+      test(function() {
+        assert_equals(typeof(position.coords[ii]), "number",
+            ii + " should be type 'number' but typeof returned: " + typeof(position.coords[ii]));
+      }, ii + " is type number");
+    }
+
+    oldval = position.coords[ii];
+    position.coords[ii] = 666;
+
+    test(function() {
+      assert_equals(position.coords[ii], oldval,
+          ii + " should be readonly, wrote: " + position.coords[ii] + " old value was " + oldval);
+    }, ii + " readonly");
+
+  }
+
+  success.done();
+  done();
+}
+
+function BadErrorCallback(error)
+{
+  success.step(function() {
+    assert_unreached("Error callback called in error");
+  });
+  success.done();
+  done();
+}
+
+function BadSuccessCallback(position)
+{
+  fail.step(function() {
+    assert_unreached("Success callback called in error");
+  });
+  fail.done();
+}
+
+function errorCallback(error)
+{
+  test(function() {
+    assert_equals(error.toString(), "[object PositionError]",
+        "PositionError.toString should result in '[object PositionError]' was: " +
+        error.toString());
+  }, "PositionError toString");
+
+  test(function() {
+    assert_equals(error.PERMISSION_DENIED, 1,
+        "PERMISSION_DENIED should be 1 was: " + error.POSITION_DENIED);
+  }, "PERMISSION_DENIED value is 1");
+
+  test(function() {
+    assert_equals(error.POSITION_UNAVAILABLE, 2,
+        "POSITION_UNAVAILABLE should be 2' was: " + error.POSITION_UNAVAILABLE);
+  }, "POSITION_UNAVAILABLE is 2");
+
+  test(function() {
+    assert_equals(error.TIMEOUT, 3,
+        "TIMEOUT should be 3 was: " + error.TIMEOUT);
+  }, "TIMEOUT value is 3");
+
+  fail.done();
+}
+
+success = async_test("getCurrentPosition success callback tests", {timeout:20000});
+
+// with a longer timeout and with the user accepting the position request,
+// this should test the successcallback
+success.step(function() {
+  geo.getCurrentPosition(
+      successCallback,
+      BadErrorCallback,
+      {maximumAge:600000, timeout:10000}
+  );
+});
+
+fail = async_test("getCurrentPosition error callback tests");
+
+// with a timeout of 0 the error callback is hopefully consistently called
+fail.step(function() {
+  geo.getCurrentPosition(
+      BadSuccessCallback,
+      errorCallback,
+      {maximumAge:00, timeout:0}
+  );
+});
+
+</script>
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.html
+++ /dev/null
@@ -1,44 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: getCurrentPosition location access allowed</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#get-current-position'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00002
-var t = async_test('User allows access, check that success callback is called or error callback is called with correct code.'),
-    onSuccess, onError, hasMethodReturned = false;
-
-onSuccess = t.step_func(function(pos) {
-  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
-  test(function() {
-    assert_true(hasMethodReturned);
-  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
-
-  done();
-});
-
-onError = t.step_func(function(err) {
-  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
-  test(function() {
-    assert_true(hasMethodReturned);
-  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
-
-  assert_true(!isUsingPreemptivePermission && err.code === err.POSITION_UNAVAILABLE);
-  done();
-});
-
-try {
-  geo.getCurrentPosition(onSuccess, onError);
-  hasMethodReturned = true;
-} catch(e) {
-  t.step(function() {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  });
-}
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_allow.https.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: getCurrentPosition location access allowed</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#get-current-position'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please allow.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00002
+var t = async_test('User allows access, check that success callback is called or error callback is called with correct code.'),
+    onSuccess, onError, hasMethodReturned = false;
+
+onSuccess = t.step_func(function(pos) {
+  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
+  test(function() {
+    assert_true(hasMethodReturned);
+  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
+
+  done();
+});
+
+onError = t.step_func(function(err) {
+  // Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00031
+  test(function() {
+    assert_true(hasMethodReturned);
+  }, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked.');
+
+  assert_true(!isUsingPreemptivePermission && err.code === err.POSITION_UNAVAILABLE);
+  done();
+});
+
+try {
+  geo.getCurrentPosition(onSuccess, onError);
+  hasMethodReturned = true;
+} catch(e) {
+  t.step(function() {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  });
+}
+</script>
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: getCurrentPosition location access denied</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#privacy_for_uas'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00001
-var t = async_test('User denies access, check that error callback is called with correct code'),
-    onSuccess, onError, hasMethodReturned = false;
-
-t.step(function() {
-  onSuccess = t.step_func(function(pos) {
-    assert_unreached('A success callback was invoked unexpectedly with position ' + positionToString(pos));
-  });
-
-  onError =  t.step_func(function(err) {
-    // http://dev.w3.org/geo/api/test-suite/t.html?00031
-    assert_true(hasMethodReturned, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked');
-    assert_equals(err.code, err.PERMISSION_DENIED,
-        'PossitionError code: ' + err.code, + ', message: ' + err.message);
-    done();
-  });
-
-  geo.getCurrentPosition(onSuccess, onError);
-  hasMethodReturned = true;
-});
-</script>
-
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/getCurrentPosition_permission_deny.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: getCurrentPosition location access denied</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#privacy_for_uas'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00001
+var t = async_test('User denies access, check that error callback is called with correct code'),
+    onSuccess, onError, hasMethodReturned = false;
+
+t.step(function() {
+  onSuccess = t.step_func(function(pos) {
+    assert_unreached('A success callback was invoked unexpectedly with position ' + positionToString(pos));
+  });
+
+  onError =  t.step_func(function(err) {
+    // http://dev.w3.org/geo/api/test-suite/t.html?00031
+    assert_true(hasMethodReturned, 'Check that getCurrentPosition returns synchronously before any callbacks are invoked');
+    assert_equals(err.code, err.PERMISSION_DENIED,
+        'PossitionError code: ' + err.code, + ', message: ' + err.message);
+    done();
+  });
+
+  geo.getCurrentPosition(onSuccess, onError);
+  hasMethodReturned = true;
+});
+</script>
+
deleted file mode 100644
--- a/testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE HTML>
-<meta charset='utf-8'>
-<title>Geolocation Test: watchPosition location access denied</title>
-<link rel='help' href='http://www.w3.org/TR/geolocation-API/#watch-position'>
-<script src='/resources/testharness.js'></script>
-<script src='/resources/testharnessreport.js'></script>
-<script src='support.js'></script>
-
-<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
-<div id='log'></div>
-
-<script>
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00062
-var t = async_test('Check that watchPosition returns synchronously before any callbacks are invoked.'),
-    id, checkMethodHasReturned, hasMethodReturned = false;
-
-checkMethodHasReturned = t.step_func(function() {
-  assert_true(hasMethodReturned);
-  done();
-});
-
-try {
-  id = geo.watchPosition(checkMethodHasReturned, checkMethodHasReturned);
-  hasMethodReturned = true;
-} catch(e) {
-  t.step(function() {
-    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
-  });
-}
-
-// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00151
-test(function() {
-  assert_greater_than_equal(id, -2147483648);
-  assert_less_than_equal(id, 2147483647);
-}, 'Check that watchPosition returns a long');
-</script>
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/geolocation-API/watchPosition_permission_deny.https.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<meta charset='utf-8'>
+<title>Geolocation Test: watchPosition location access denied</title>
+<link rel='help' href='http://www.w3.org/TR/geolocation-API/#watch-position'>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='support.js'></script>
+
+<p>Clear all Geolocation permissions before running this test. If prompted for permission, please deny.</p>
+<div id='log'></div>
+
+<script>
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00062
+var t = async_test('Check that watchPosition returns synchronously before any callbacks are invoked.'),
+    id, checkMethodHasReturned, hasMethodReturned = false;
+
+checkMethodHasReturned = t.step_func(function() {
+  assert_true(hasMethodReturned);
+  done();
+});
+
+try {
+  id = geo.watchPosition(checkMethodHasReturned, checkMethodHasReturned);
+  hasMethodReturned = true;
+} catch(e) {
+  t.step(function() {
+    assert_unreached('An exception was thrown unexpectedly: ' + e.message);
+  });
+}
+
+// Rewrite http://dev.w3.org/geo/api/test-suite/t.html?00151
+test(function() {
+  assert_greater_than_equal(id, -2147483648);
+  assert_less_than_equal(id, 2147483647);
+}, 'Check that watchPosition returns a long');
+</script>