[Cronet] Do not follow Http <-> Https redirects

[Cronet] Do not follow Http <-> Https redirects

If redirect URLs do not have the same scheme as the original
URLs, do not follow the redirects. This is done to match
documented reference implementation behavior, not because it
is advisable to block redirects to HTTPS.

BUG=540730
Committed: https://crrev.com/79ff7492d7f58374a5470ef8f08909a0e7db8fd9
Cr-Commit-Position: refs/heads/master@{#356865}

[xunjieli, 2015-10-26 16:12:57]

Patchset #1 (id:1) has been deleted

[xunjieli, 2015-10-26 16:13:02]

Patchset #1 (id:20001) has been deleted

[xunjieli, 2015-10-26 16:13:07]

Patchset #1 (id:40001) has been deleted

[xunjieli, 2015-10-26 16:27:23]

Patchset #1 (id:60001) has been deleted

[xunjieli, 2015-10-26 16:27:57]

xunjieli@chromium.org changed reviewers:
+ pauljensen@chromium.org

[xunjieli, 2015-10-26 16:27:57]

Paul, PTAL.

[pauljensen, 2015-10-29 13:08:52]

lgtm with a couple comments on the commit description:
1. Change urls->URLs.
2. Add "This is done to match documented reference implementation behavior, not
because it is advisable to block redirects to HTTPS." or something along those
lines.  Personally blocking HTTP->HTTPS redirection seems like a significant
security limitation but that's just how it's documented to operate.

[xunjieli, 2015-10-29 16:14:44]

Description was changed from

==========
[Cronet] Do not follow Http <-> Https redirects

If redirect urls do not have the same scheme as the original urls, do not follow
the redirects.

BUG=540730
==========

to

==========
[Cronet] Do not follow Http <-> Https redirects

If redirect URLs do not have the same scheme as the original 
URLs, do not follow the redirects. This is done to match 
documented reference implementation behavior, not because it 
is advisable to block redirects to HTTPS.

BUG=540730
==========

[xunjieli, 2015-10-29 16:16:19]

On 2015/10/29 13:08:52, pauljensen wrote:
> lgtm with a couple comments on the commit description:
> 1. Change urls->URLs.
> 2. Add "This is done to match documented reference implementation behavior,
not
> because it is advisable to block redirects to HTTPS." or something along those
> lines.  Personally blocking HTTP->HTTPS redirection seems like a significant
> security limitation but that's just how it's documented to operate.

Done. Thanks!

[xunjieli, 2015-10-29 16:16:26]

The CQ bit was checked by xunjieli@chromium.org

[commit-bot: I haz the power, 2015-10-29 16:16:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1404423006/80001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1404423006/80001

[commit-bot: I haz the power, 2015-10-29 16:27:03]

Committed patchset #1 (id:80001)

[commit-bot: I haz the power, 2015-10-29 16:27:43]

Patchset 1 (id:??) landed as
https://crrev.com/79ff7492d7f58374a5470ef8f08909a0e7db8fd9
Cr-Commit-Position: refs/heads/master@{#356865}