Support whitelisting to handle insecure origins as trustworthy origins (chromium)

chrome/common/secure_origin_whitelist_unittest.cc

Index: chrome/common/secure_origin_whitelist_unittest.cc
diff --git a/chrome/common/secure_origin_whitelist_unittest.cc b/chrome/common/secure_origin_whitelist_unittest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..068f2073e26799ade055badccd74c9ff85293574
--- /dev/null
+++ b/chrome/common/secure_origin_whitelist_unittest.cc
@@ -0,0 +1,36 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/basictypes.h"

[jww, 2015/04/30 18:26:42]

remove?

[kinuko, 2015/05/01 03:10:56]

Done.

+#include "base/command_line.h"
+#include "chrome/common/chrome_switches.h"
+#include "content/public/common/origin_util.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+using content::IsOriginSecure;
+
+namespace chrome {
+
+TEST(SecureOriginWhiteList, UnsafetyTreatInsecureOriginAsSecure) {
+  EXPECT_FALSE(content::IsOriginSecure(GURL("http://example.com/fun.html")));
+  EXPECT_FALSE(
+      content::IsOriginSecure(GURL("http://127.example.com/fun.html")));
+
+  // Add http://example.com and http://127.example.com to whitelist by
+  // command-line and see if they are now considered secure origins.
+  // (The command line is applied via
+  // ChromeContentClient::AddSecureSchemesAndOrigins)
+  base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
+  command_line->AppendSwitchASCII(
+      switches::kUnsafetyTreatInsecureOriginAsSecure,
+      "http://example.com,http://127.example.com");
+  command_line->AppendSwitch(switches::kUserDataDir);
+  content::ResetSecureSchemesAndOriginsForTesting();
+
+  EXPECT_TRUE(content::IsOriginSecure(GURL("http://example.com/fun.html")));
+  EXPECT_TRUE(content::IsOriginSecure(GURL("http://127.example.com/fun.html")));

[jww, 2015/04/30 18:26:42]

Would you mind adding a few other sanity checks, such as verifing that
http://128.example.com is *not* considered secure, or similarly that
http://foobar.127.example.com is also not secure?

[kinuko, 2015/05/01 03:10:56]

Done.

+}
+
+}  // namespace chrome