Command line switch for the ultra security concious: --force-https!...

net/url_request/url_request_http_job.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
+#include "base/base_switches.h"
+#include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/file_version_info.h"
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "net/base/cookie_monster.h"
 #include "net/base/filter.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
@@ skipping 13 matching lines @@
 
   if (!net::IsPortAllowedByDefault(request->url().IntPort()))
     return new URLRequestErrorJob(request, net::ERR_UNSAFE_PORT);
 
   if (!request->context() ||
       !request->context()->http_transaction_factory()) {
     NOTREACHED() << "requires a valid context";
     return new URLRequestErrorJob(request, net::ERR_INVALID_ARGUMENT);
   }
 
+  // We cache the value of the switch because this code path is hit on every
+  // network request.
+  static const bool kForceHTTPS =
+        CommandLine().HasSwitch(switches::kForceHTTPS);

[wtc, 2008/12/15 18:14:15]

Nit: this line seems to be over-indented.

+  if (kForceHTTPS && scheme == "http")

[jar (doing other things), 2008/12/15 08:34:17]

Perhaps you should even be more aggressive and use:
scheme != "https" ?

That would preclude ftp for example.

+    return new URLRequestErrorJob(request, net::ERR_DISALLOWED_URL_SCHEME);
+
   return new URLRequestHttpJob(request);
 }
 
 URLRequestHttpJob::URLRequestHttpJob(URLRequest* request)
     : URLRequestJob(request),
       transaction_(NULL),
       response_info_(NULL),
       proxy_auth_state_(net::AUTH_STATE_DONT_NEED_AUTH),
       server_auth_state_(net::AUTH_STATE_DONT_NEED_AUTH),
       ALLOW_THIS_IN_INITIALIZER_LIST(
@@ skipping 318 matching lines @@
   // If the transaction was destroyed, then the job was cancelled, and
   // we can just ignore this notification.
   if (!transaction_.get())
     return;
 
   // Clear the IO_PENDING status
   SetStatus(URLRequestStatus());
 
   if (result == net::OK) {
     NotifyHeadersComplete();
-  } else if (net::IsCertificateError(result)) {
+  } else if (net::IsCertificateError(result) &&
+             !CommandLine().HasSwitch(switches::kForceHTTPS)) {
     // We encountered an SSL certificate error.  Ask our delegate to decide
     // what we should do.
     // TODO(wtc): also pass ssl_info.cert_status, or just pass the whole
     // ssl_info.
     request_->delegate()->OnSSLCertificateError(
         request_, result, transaction_->GetResponseInfo()->ssl_info.cert);
   } else {
     NotifyStartError(URLRequestStatus(URLRequestStatus::FAILED, result));
   }
 }
@@ skipping 146 matching lines @@
   DCHECK(response_cookies_.empty());
 
   std::string name = "Set-Cookie";
   std::string value;
 
   void* iter = NULL;
   while (response_info_->headers->EnumerateHeader(&iter, name, &value))
     response_cookies_.push_back(value);
 }