Merge 34751 - If we redirect from an https to an http site, ensure that we do...

net/url_request/url_request.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request.h"
 
 #include "base/compiler_specific.h"
 #include "base/message_loop.h"
 #include "base/singleton.h"
 #include "base/stats_counters.h"
@@ skipping 441 matching lines @@
     // NOTE: Even though RFC 2616 says to preserve the request method when
     // following a 302 redirect, normal browsers don't do that.  Instead, they
     // all convert a POST into a GET in response to a 302 and so shall we.  For
     // 307 redirects, browsers preserve the method.  The RFC says to prompt the
     // user to confirm the generation of a new POST request, but IE omits this
     // prompt and so shall we.
     strip_post_specific_headers = method_ == "POST";
     method_ = "GET";
     upload_ = NULL;
   }
+
+  // Suppress the referrer if we're redirecting out of https.
+  if (GURL(referrer_).SchemeIsSecure() && !location.SchemeIsSecure())
+    referrer_.clear();
+
   url_ = location;
   --redirect_limit_;
 
   if (strip_post_specific_headers) {
     // If being switched from POST to GET, must remove headers that were
     // specific to the POST and don't have meaning in GET. For example
     // the inclusion of a multipart Content-Type header in GET can cause
     // problems with some servers:
     // http://code.google.com/p/chromium/issues/detail?id=843
     //
@@ skipping 46 matching lines @@
 void URLRequest::SetUserData(const void* key, UserData* data) {
   user_data_[key] = linked_ptr<UserData>(data);
 }
 
 void URLRequest::GetInfoForTracker(
     RequestTracker<URLRequest>::RecentRequestInfo* info) const {
   DCHECK(info);
   info->original_url = original_url_;
   info->load_log = load_log_;
 }