Switch SchemeIsSecure to SchemeIsCryptographic for referrer-related code.

Switch SchemeIsSecure to SchemeIsCryptographic for referrer-related code.

BUG=362214
Committed: https://crrev.com/e8e59d4fd70ff8f2332cbc9f54a57068a95077d3
Cr-Commit-Position: refs/heads/master@{#327168}

[lgarron, 2015-04-24 20:06:28]

lgarron@chromium.org changed reviewers:
+ mkwst@chromium.org, palmer@chromium.org

[lgarron, 2015-04-24 20:06:29]

This CL has been split out from https://codereview.chromium.org/1101173004

Mike, do you know if referrer stripping should happen just from cryptographic
schemes to non-cryptographic ones, or from privileged contexts to non-privileged
ones?






From palmer@ in the other CL:

"Regarding Referer header checks, see sections 14.36, 15.1.2, and 15.1.3 in
http://tools.ietf.org/html/rfc2616.

"""The Referer field MUST NOT be sent if the Request-URI was obtained from a
source that does not have its own URI, such as input from the user keyboard."""

"""Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP
request if the referring page was transferred with a secure protocol."""

I am inclined to agree that we should also NOT send it when navigating from
private zones to public ones (e.g. localhost, file:, localdomain, et c.). That
*might* line up exactly with IsOriginSecure, now or in the future, but I
wouldn't bet on it staying that way. Probably Referer checking should have its
own logic (definitely making use of GURL::SchemeIsCryptographic, but also using
other stuff)."

[palmer, 2015-04-24 20:14:28]

LGTM.

[Mike West, 2015-04-26 07:53:49]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2015-04-26 07:53:49]

This looks right to me, but let's ask Jochen as well, as he's doing most of the
actual coding with regard to referrers.

[palmer, 2015-04-27 18:56:12]

palmer@chromium.org changed reviewers:
+ davidben@chromium.org, stuartmorgan@chromium.org

[palmer, 2015-04-27 18:56:13]

+davidben: net/OWNERS
+stuartmorgan: ios/web/OWNERS

[davidben, 2015-04-27 18:57:31]

net lgtm

[palmer, 2015-04-27 18:59:12]

palmer@chromium.org changed reviewers:
+ noelutz@chromium.org, sky@chromium.org

[palmer, 2015-04-27 18:59:12]

> +davidben: net/OWNERS

Also content/OWNERS

+sky: components/sessions/OWNERS

+noelutz: chrome/browser/safe_browsing/OWNERS

Thanks, all!

[davidben, 2015-04-27 19:11:44]

On 2015/04/27 18:59:12, palmer wrote:
> > +davidben: net/OWNERS
> 
> Also content/OWNERS

content lgtm too

[jochen (gone - plz use gerrit), 2015-04-27 19:56:43]

lgtm

[stuartmorgan, 2015-04-27 20:03:34]

ios/web LGTM

[sky, 2015-04-27 21:10:32]

LGTM

[lgarron, 2015-04-27 22:11:06]

The CQ bit was checked by lgarron@chromium.org

[lgarron, 2015-04-27 22:11:06]

The patchset sent to the CQ was uploaded after l-g-t-m from palmer@chromium.org
Link to the patchset: https://codereview.chromium.org/1098983003/#ps20001
(title: " ")

[commit-bot: I haz the power, 2015-04-27 22:11:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1098983003/20001

[commit-bot: I haz the power, 2015-04-27 23:07:43]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-04-27 23:08:40]

Patchset 2 (id:??) landed as
https://crrev.com/e8e59d4fd70ff8f2332cbc9f54a57068a95077d3
Cr-Commit-Position: refs/heads/master@{#327168}

[Ryan Sleevi, 2015-04-28 00:01:14]

Drive-by review: The CL description is extremely light. It looks like you
captured some of it on your first note, but that is great context to actually
add in to the commit note.

That is, assuming no one saw this review, and only saw the commit, could they
understand the "What, why, and background". The one-liner gives a somewhat clear
explanation of "What", but lacks the "Why" and "Background"

[lgarron, 2015-04-28 21:49:32]

On 2015/04/28 at 00:01:14, rsleevi wrote:
> Drive-by review: The CL description is extremely light. It looks like you
captured some of it on your first note, but that is great context to actually
add in to the commit note.
> 
> That is, assuming no one saw this review, and only saw the commit, could they
understand the "What, why, and background". The one-liner gives a somewhat clear
explanation of "What", but lacks the "Why" and "Background"

Ryan: Sorry, the commit had just landed. :-(
I'll make sure to include more W's in the counterparts to this commit.