Add a check that we don't send a secure referrer to an insecure URL

net/url_request/url_request.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
@@ skipping 666 matching lines @@
   job_->SetPriority(priority_);
 
   if (upload_data_stream_.get())
     job_->SetUpload(upload_data_stream_.get());
 
   is_pending_ = true;
   is_redirecting_ = false;
 
   response_info_.was_cached = false;
 
+  // If the referrer is secure, but the requested URL is not, the referrer
+  // policy should be something non-default. If you hit this, please file a
+  // bug.
+  CHECK(!(GURL(referrer_).SchemeIsSecure() && !url().SchemeIsSecure()) ||
+        referrer_policy_ !=
+            CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE);

[mef, 2013/12/16 16:39:01]

I'd keep it as DCHECK to avoid non-critical crashes.

[jochen (gone - plz use gerrit), 2013/12/16 19:25:51]

IMO a DCHECK is almost pointless. And it is a  critical error if this happens in
the wild.

+
   // Don't allow errors to be sent from within Start().
   // TODO(brettw) this may cause NotifyDone to be sent synchronously,
   // we probably don't want this: they should be sent asynchronously so
   // the caller does not get reentered.
   job_->Start();
 }
 
 void URLRequest::Restart() {
   // Should only be called if the original job didn't make any progress.
   DCHECK(job_.get() && !job_->has_response_started());
@@ skipping 494 matching lines @@
       new base::debug::StackTrace(NULL, 0);
   *stack_trace_copy = stack_trace;
   stack_trace_.reset(stack_trace_copy);
 }
 
 const base::debug::StackTrace* URLRequest::stack_trace() const {
   return stack_trace_.get();
 }
 
 }  // namespace net