Add IsOriginSecure and GURL::SchemeUsesTLS.

chrome/common/origin_util.cc

Index: chrome/common/origin_util.cc
diff --git a/chrome/common/origin_util.cc b/chrome/common/origin_util.cc
new file mode 100644
index 0000000000000000000000000000000000000000..c84180ba580879423a9203d3c8c6a6977f0e5f9c
--- /dev/null
+++ b/chrome/common/origin_util.cc
@@ -0,0 +1,33 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/origin_util.h"
+
+#include "content/public/common/url_constants.h"
+#include "extensions/common/constants.h"
+#include "net/base/net_util.h"
+#include "url/gurl.h"
+
+bool IsOriginSecure(const GURL& url) {
+  if (url.SchemeUsesTLS() || url.SchemeIsFile())

[markusheintz_, 2015/04/15 14:12:36]

hm ... I may remember something wrong here (sorry if that is the case) but
didn't you or somebody else from the security team plan to treat file URLs as
not secure? 

They could be from some network share for example.

[palmer, 2015/04/16 17:15:40]

We decided that, as far as the browser can know, the files effectively come from
the local machine. They could have been copied from a non-secure network
filesystem like SMB/CIFS, but we think that is relatively rare and not something
the browser can reliably determine. We wanted to err on the side of usability
for developers, and make secure-origin-only features available to file://.

+    return true;
+
+  if (url.SchemeIsFileSystem() && url.inner_url() &&
+      IsOriginSecure(*url.inner_url())) {
+    return true;
+  }
+
+  std::string hostname = url.HostNoBrackets();
+  if (net::IsLocalhost(hostname) || net::IsLocalhostTLD(hostname))

[estark, 2015/04/15 00:35:52]

Was just looking at this out of curiosity and noticed that the |IsLocalhostTLD|
check isn't necessary here; |IsLocalhost| already checks that.
https://code.google.com/p/chromium/codesearch#chromium/src/net/base/net_util....

(Sorry if that wasn't clear... I guess the comment on the |IsLocahost|
declaration should say so.)

[palmer, 2015/04/16 17:15:40]

Ah, thanks.
I think it is clear in retrospect. :)

+    return true;
+
+  std::string scheme = url.scheme();
+  if (scheme == content::kChromeUIScheme ||
+      scheme == extensions::kExtensionScheme ||
+      scheme == extensions::kExtensionResourceScheme) {
+    return true;
+  }
+
+  return false;
+}