Warn when committing code with http:// URLs.

PRESUBMIT.py

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Top-level presubmit script for Chromium.
 
 See http://dev.chromium.org/developers/how-tos/depottools/presubmit-scripts
 for more details about the presubmit API built into gcl.
 """
 
@@ skipping 39 matching lines @@
 )
 
 _TEST_ONLY_WARNING = (
     'You might be calling functions intended only for testing from\n'
     'production code.  It is OK to ignore this warning if you know what\n'
     'you are doing, as the heuristics used to detect the situation are\n'
     'not perfect.  The commit queue will not block on this warning.\n'
     'Email joi@chromium.org if you have questions.')
 
 
+_HTTPS_ONLY_WARNING = (
+    'You should prefer to refer to HTTPS URLs, rather than HTTP URLs.\n'
+    'Do not bypass this warning if there is an equivalent HTTPS endpoint\n'
+    'that you could refer to instead. (Contact: palmer@chromium.org)')
+
+
 _INCLUDE_ORDER_WARNING = (
     'Your #include order seems to be broken. Send mail to\n'
     'marja@chromium.org if this is not the case.')
 
 
 _BANNED_OBJC_FUNCTIONS = (
     (
       'addTrackingRect:',
       (
        'The use of -[NSView addTrackingRect:owner:userData:assumeInside:] is'
@@ skipping 117 matching lines @@
                   _TEST_CODE_EXCLUDED_PATHS +
                   input_api.DEFAULT_BLACK_LIST)
     return input_api.FilterSourceFile(
       affected_file,
       white_list=(file_inclusion_pattern, ),
       black_list=black_list)
 
   problems = []
   for f in input_api.AffectedSourceFiles(FilterFile):
     local_path = f.LocalPath()
-    lines = input_api.ReadFile(f).splitlines()
-    line_number = 0
-    for line in lines:
-      if (inclusion_pattern.search(line) and
-          not exclusion_pattern.search(line)):
+    for line_number, line in enumerate(input_api.ReadFile(f).splitlines()):
+      if inclusion_pattern.search(line) and not exclusion_pattern.search(line):
         problems.append(
-          '%s:%d\n    %s' % (local_path, line_number, line.strip()))
-      line_number += 1
+          '%s:%d\n    %s' % (local_path, line_number + 1, line.strip()))
 
   if problems:
-    if not input_api.is_committing:
-      return [output_api.PresubmitPromptWarning(_TEST_ONLY_WARNING, problems)]
-    else:
+    if input_api.is_committing:
       # We don't warn on commit, to avoid stopping commits going through CQ.
       return [output_api.PresubmitNotifyResult(_TEST_ONLY_WARNING, problems)]
-  else:
-    return []
+    else:
+      return [output_api.PresubmitPromptWarning(_TEST_ONLY_WARNING, problems)]
+
+  return []
+
+
+def _CheckNoHttpUrls(input_api, output_api):
+  """Attempts to prevent use of http:// URLs. Production Chrome code, and
+  Chromium infrastructure code, should strive to use https:// URLs (preferably
+  HSTS and with pinned public keys, as well). Some URLs will not be
+  translatable, but gradually the number of those should diminish.
+  """
+
+  # Include all sorts of files, both code and infrastructure scripts.
+  file_inclusion_pattern = r'.+\.(h|cc|cpp|cxx|mm|py|bat|sh)$'
+
+  inclusion_pattern = input_api.re.compile(r'''["']http:/''',
+                                           input_api.re.IGNORECASE)
+
+  # Allow http:/ in comments. https://chromium.org and
+  # https://cr{bug,osbug,rev}.com don't work yet. See e.g.
+  # https://code.google.com/p/chromium/issues/detail?id=106096.
+  # TODO(palmer): Remove this once 106096 and its dependent bugs are fixed.
+  exclusion_pattern = input_api.re.compile(r'(#|//|/\*| \*).*http:/',
+                                           input_api.re.IGNORECASE)
+
+  def FilterFile(affected_file):
+    black_list = (_TEST_CODE_EXCLUDED_PATHS +
+                  input_api.DEFAULT_BLACK_LIST)
+    return input_api.FilterSourceFile(
+      affected_file,
+      white_list=(file_inclusion_pattern, ),
+      black_list=black_list)
+
+  problems = []
+  for f in input_api.AffectedSourceFiles(FilterFile):
+    local_path = f.LocalPath()
+    for line_number, line in enumerate(input_api.ReadFile(f).splitlines()):
+      if inclusion_pattern.search(line) and not exclusion_pattern.search(line):
+        problems.append(
+          '%s:%d\n    %s' % (local_path, line_number + 1, line.strip()))
+
+  if problems:
+    if input_api.is_committing:
+      # We don't warn on commit, to avoid stopping commits going through CQ.
+      return [output_api.PresubmitNotifyResult(_HTTPS_ONLY_WARNING, problems)]
+    else:
+      return [output_api.PresubmitPromptWarning(_HTTPS_ONLY_WARNING, problems)]
+
+  return []
 
 
 def _CheckNoIOStreamInHeaders(input_api, output_api):
   """Checks to make sure no .h files include <iostream>."""
   files = []
   pattern = input_api.re.compile(r'^#include\s*<iostream>',
                                  input_api.re.MULTILINE)
   for f in input_api.AffectedSourceFiles(input_api.FilterSourceFile):
     if not f.LocalPath().endswith('.h'):
       continue
@@ skipping 190 matching lines @@
       error_descriptions.append(description_with_path)
     else:
       warning_descriptions.append(description_with_path)
 
   results = []
   if error_descriptions:
     results.append(output_api.PresubmitError(
         'You added one or more #includes that violate checkdeps rules.',
         error_descriptions))
   if warning_descriptions:
-    if not input_api.is_committing:
-      warning_factory = output_api.PresubmitPromptWarning
-    else:
+    if input_api.is_committing:
       # We don't want to block use of the CQ when there is a warning
       # of this kind, so we only show a message when committing.
       warning_factory = output_api.PresubmitNotifyResult
+    else:
+      warning_factory = output_api.PresubmitPromptWarning
     results.append(warning_factory(
         'You added one or more #includes of files that are temporarily\n'
         'allowed but being removed. Can you avoid introducing the\n'
         '#include? See relevant DEPS file(s) for details and contacts.',
         warning_descriptions))
   return results
 
 
 def _CheckFilePermissions(input_api, output_api):
   """Check that all files have their permissions properly set."""
@@ skipping 157 matching lines @@
   """
 
   warnings = []
   for f in input_api.AffectedFiles():
     if f.LocalPath().endswith(('.cc', '.h')):
       changed_linenums = set(line_num for line_num, _ in f.ChangedContents())
       warnings.extend(_CheckIncludeOrderInFile(input_api, f, changed_linenums))
 
   results = []
   if warnings:
-    if not input_api.is_committing:
-      results.append(output_api.PresubmitPromptWarning(_INCLUDE_ORDER_WARNING,
-                                                       warnings))
-    else:
+    if input_api.is_committing:
       # We don't warn on commit, to avoid stopping commits going through CQ.
       results.append(output_api.PresubmitNotifyResult(_INCLUDE_ORDER_WARNING,
                                                       warnings))
+    else:
+      results.append(output_api.PresubmitPromptWarning(_INCLUDE_ORDER_WARNING,
+                                                       warnings))
   return results
 
 
 def _CheckForVersionControlConflictsInFile(input_api, f):
   pattern = input_api.re.compile('^(?:<<<<<<<|>>>>>>>) |^=======$')
   errors = []
   for line_num, line in f.ChangedContents():
     if pattern.match(line):
       errors.append('    %s:%d %s' % (f.LocalPath(), line_num, line))
   return errors
@@ skipping 27 matching lines @@
                   input_api.DEFAULT_BLACK_LIST))
 
   pattern = input_api.re.compile('"[^"]*google\.com[^"]*"')
   problems = []  # items are (filename, line_number, line)
   for f in input_api.AffectedSourceFiles(FilterFile):
     for line_num, line in f.ChangedContents():
       if pattern.search(line):
         problems.append((f.LocalPath(), line_num, line))
 
   if problems:
-    if not input_api.is_committing:
-      warning_factory = output_api.PresubmitPromptWarning
-    else:
+    if input_api.is_committing:
       # We don't want to block use of the CQ when there is a warning
       # of this kind, so we only show a message when committing.
       warning_factory = output_api.PresubmitNotifyResult
+    else:
+      warning_factory = output_api.PresubmitPromptWarning
     return [warning_factory(
         'Most layers below src/chrome/ should not hardcode service URLs.\n'
         'Are you sure this is correct? (Contact: joi@chromium.org)',
         ['  %s:%d:  %s' % (
             problem[0], problem[1], problem[2]) for problem in problems])]
-  else:
-    return []
+
+  return []
 
 
 def _CommonChecks(input_api, output_api):
   """Checks common to both upload and commit."""
   results = []
   results.extend(input_api.canned_checks.PanProjectChecks(
       input_api, output_api, excluded_paths=_EXCLUDED_PATHS))
   results.extend(_CheckAuthorizedAuthor(input_api, output_api))
   results.extend(
     _CheckNoProductionCodeUsingTestOnlyFunctions(input_api, output_api))
   results.extend(_CheckNoIOStreamInHeaders(input_api, output_api))
   results.extend(_CheckNoUNIT_TESTInSourceFiles(input_api, output_api))
   results.extend(_CheckNoNewWStrings(input_api, output_api))
   results.extend(_CheckNoDEPSGIT(input_api, output_api))
   results.extend(_CheckNoBannedFunctions(input_api, output_api))
   results.extend(_CheckNoPragmaOnce(input_api, output_api))
   results.extend(_CheckNoTrinaryTrueFalse(input_api, output_api))
   results.extend(_CheckUnwantedDependencies(input_api, output_api))
   results.extend(_CheckFilePermissions(input_api, output_api))
   results.extend(_CheckNoAuraWindowPropertyHInHeaders(input_api, output_api))
   results.extend(_CheckIncludeOrder(input_api, output_api))
   results.extend(_CheckForVersionControlConflicts(input_api, output_api))
   results.extend(_CheckPatchFiles(input_api, output_api))
   results.extend(_CheckHardcodedGoogleHostsInLowerLayers(input_api, output_api))
+  results.extend(_CheckNoHttpUrls(input_api, output_api))
 
   if any('PRESUBMIT.py' == f.LocalPath() for f in input_api.AffectedFiles()):
     results.extend(input_api.canned_checks.RunUnitTestsInDirectory(
         input_api, output_api,
         input_api.PresubmitLocalPath(),
         whitelist=[r'.+_test\.py$']))
   return results
 
 
 def _CheckSubversionConfig(input_api, output_api):
@@ skipping 68 matching lines @@
         author)]
   return []
 
 
 def _CheckPatchFiles(input_api, output_api):
   problems = [f.LocalPath() for f in input_api.AffectedFiles()
       if f.LocalPath().endswith(('.orig', '.rej'))]
   if problems:
     return [output_api.PresubmitError(
         "Don't commit .rej and .orig files.", problems)]
-  else:
-    return []
+
+  return []
 
 
 def CheckChangeOnUpload(input_api, output_api):
   results = []
   results.extend(_CommonChecks(input_api, output_api))
   return results
 
 
 def CheckChangeOnCommit(input_api, output_api):
   results = []
   results.extend(_CommonChecks(input_api, output_api))
   # TODO(thestig) temporarily disabled, doesn't work in third_party/
   #results.extend(input_api.canned_checks.CheckSvnModifiedDirectories(
   #    input_api, output_api, sources))
   # Make sure the tree is 'open'.
   results.extend(input_api.canned_checks.CheckTreeIsOpen(
       input_api,
       output_api,
-      json_url='http://chromium-status.appspot.com/current?format=json'))
+      json_url='https://chromium-status.appspot.com/current?format=json'))
   results.extend(input_api.canned_checks.CheckRietveldTryJobExecution(input_api,
-      output_api, 'http://codereview.chromium.org',
+      output_api, 'https://codereview.chromium.org',
       ('win_rel', 'linux_rel', 'mac_rel, win:compile'),
       'tryserver@chromium.org'))
 
   results.extend(input_api.canned_checks.CheckChangeHasBugField(
       input_api, output_api))
   results.extend(input_api.canned_checks.CheckChangeHasDescription(
       input_api, output_api))
   results.extend(_CheckSubversionConfig(input_api, output_api))
   return results
 
@@ skipping 30 matching lines @@
       'win7_aura',
       'win_rel',
   ]
 
   # Match things like path/aura/file.cc and path/file_aura.cc.
   # Same for chromeos.
   if any(re.search('[/_](aura|chromeos)', f) for f in files):
     trybots += ['linux_chromeos_clang:compile', 'linux_chromeos_asan']
 
   return trybots