Upgrade insecure requests: Pipe navigational hosts down into nested documents.

Upgrade insecure requests: Pipe navigational hosts down into nested documents.

After [1], we need to track hosts (including ancestor hosts) that have
set the 'upgrade-insecure-requests' directive in their respective policies
in order to correctly upgrade navigational requests to one of those
hosts.

This patch adds a 'HashSet<unsigned>' to SecurityContext that holds the
hashes of the hosts which have opted-into such treatment, ensures that
the set is correctly populated when creating a Document or applying a
policy, and uses the set to make decisions about navigational upgrades
inside ResourceFetcher.

[1]: https://github.com/w3c/webappsec/commit/f947b75e9b906c53d0bd6e66ca59b60bfe0aa20e

-----------------------------------------------------------------------
This relands  https://src.chromium.org/viewvc/blink?view=rev&revision=191421
which was reverted to fix crashes tracked in https://crbug.com/465497.
These crashes turned out to be a different patch's fault, but I've added
a few null checks anyway, as Yoav correctly noted that they were missing.
-----------------------------------------------------------------------


BUG=455674
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=192082

[Mike West, 2015-03-17 13:18:08]

mkwst@chromium.org changed reviewers:
+ yoav@yoav.ws

[Mike West, 2015-03-17 13:18:09]

One more, Yoav. You reviewed this before it was reverted; now it's back with
extra null checks (even though the original patch wasn't actually causing the
crashes we reverted it for...).

[Yoav Weiss, 2015-03-17 15:17:28]

A few extra null checks/ASSERTs?

https://codereview.chromium.org/1010893003/diff/20001/Source/core/frame/csp/C...
File Source/core/frame/csp/ContentSecurityPolicy.cpp (right):

https://codereview.chromium.org/1010893003/diff/20001/Source/core/frame/csp/C...
Source/core/frame/csp/ContentSecurityPolicy.cpp:182: }
Are we sure that securityOrigin is not null? Same Q for impl().

If yes, let's add ASSERTs here, otherwise, NULL checks?

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
File Source/core/loader/FrameLoader.cpp (right):

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
Source/core/loader/FrameLoader.cpp:1425: Frame* parentFrame =
m_frame->tree().parent();
ASSERT for m_frame? (although the rest of the file doesn't do that for some
reason...)

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
Source/core/loader/FrameLoader.cpp:1434: return
toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
are we sure the parent frame has a doc?

[Mike West, 2015-03-18 09:31:53]

Mind taking another look?

https://codereview.chromium.org/1010893003/diff/20001/Source/core/frame/csp/C...
File Source/core/frame/csp/ContentSecurityPolicy.cpp (right):

https://codereview.chromium.org/1010893003/diff/20001/Source/core/frame/csp/C...
Source/core/frame/csp/ContentSecurityPolicy.cpp:182: }
On 2015/03/17 at 15:17:27, Yoav Weiss wrote:
> Are we sure that securityOrigin is not null? Same Q for impl().
> 
> If yes, let's add ASSERTs here, otherwise, NULL checks?

ASSERT and isNull() added.

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
File Source/core/loader/FrameLoader.cpp (right):

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
Source/core/loader/FrameLoader.cpp:1425: Frame* parentFrame =
m_frame->tree().parent();
On 2015/03/17 15:17:28, Yoav Weiss wrote:
> ASSERT for m_frame? (although the rest of the file doesn't do that for some
> reason...)

Done.

https://codereview.chromium.org/1010893003/diff/20001/Source/core/loader/Fram...
Source/core/loader/FrameLoader.cpp:1434: return
toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
On 2015/03/17 15:17:28, Yoav Weiss wrote:
> are we sure the parent frame has a doc?

If the parent frame didn't have a doc, it wouldn't be this frame's parent, would
it? I'll add an assert.

[Yoav Weiss, 2015-03-18 09:48:35]

LGTM % 1 more assert

https://codereview.chromium.org/1010893003/diff/40001/Source/core/loader/Fram...
File Source/core/loader/FrameLoader.cpp (right):

https://codereview.chromium.org/1010893003/diff/40001/Source/core/loader/Fram...
Source/core/loader/FrameLoader.cpp:1436: return
toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
Yeah, obviously parentFrame should have a document. That's what 3 hour of sleep
nights get you... :)

Can you add an ASSERT above this line as well?

[Mike West, 2015-03-18 10:32:08]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2015-03-18 10:32:09]

The patchset sent to the CQ was uploaded after l-g-t-m from yoav@yoav.ws
Link to the patchset: https://codereview.chromium.org/1010893003/#ps60001
(title: "MOARASSERT")

[commit-bot: I haz the power, 2015-03-18 10:32:24]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1010893003/60001

[commit-bot: I haz the power, 2015-03-18 12:23:45]

Committed patchset #4 (id:60001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=192082