Don't allow FTP requests to HSTS-enabled domains.

Don't allow FTP requests to HSTS-enabled domains.

BUG=551468

[palmer, 2015-11-12 21:31:14]

palmer@chromium.org changed reviewers:
+ cbentzel@chromium.org, ellyjones@chromium.org

[palmer, 2015-11-12 21:31:14]

ellyjones and I discussed this approach to mitigating/defending in depth for FTP
requests to HTTPS domains. LGTY? It's simple and works (I get the expected gray
error page for ftp://mail.google.com:21/.)

[Elly Fong-Jones, 2015-11-13 14:20:08]

lgtm

[cbentzel, 2015-11-13 15:13:00]

On 2015/11/13 14:20:08, Elly Jones wrote:
> lgtm

Will think more later today. Seems reasonable. Worried that it might be hard to
debug when a bug report comes in.

[palmer, 2015-11-13 18:50:10]

> Will think more later today. Seems reasonable. Worried that it might be hard
to
> debug when a bug report comes in.

if we know the domain is an HSTS domain, or the reporter can check on
chrome://net-internals/#hsts, that will simplify debugging.

[cbentzel, 2015-11-14 01:08:54]

On 2015/11/13 18:50:10, palmer wrote:
> > Will think more later today. Seems reasonable. Worried that it might be hard
> to
> > debug when a bug report comes in.
> 
> if we know the domain is an HSTS domain, or the reporter can check on
> chrome://net-internals/#hsts, that will simplify debugging.

Let's hold off on this CL. Code seems fine (although wondering if NULL should be
returned rather than ErrorJob) but want a bit more confirmation about whether
this is a problem worth tackling in first place.

[cbentzel, 2016-01-09 13:42:20]

On 2015/11/14 01:08:54, cbentzel wrote:
> On 2015/11/13 18:50:10, palmer wrote:
> > > Will think more later today. Seems reasonable. Worried that it might be
hard
> > to
> > > debug when a bug report comes in.
> > 
> > if we know the domain is an HSTS domain, or the reporter can check on
> > chrome://net-internals/#hsts, that will simplify debugging.
> 
> Let's hold off on this CL. Code seems fine (although wondering if NULL should
be
> returned rather than ErrorJob) but want a bit more confirmation about whether
> this is a problem worth tackling in first place.

Can you close this CL? I think we decided not to do this and like to clear out
my dashboard of inbound reviews,

[palmer, 2016-01-12 00:43:50]

> Can you close this CL? I think we decided not to do this and like to clear out
> my dashboard of inbound reviews,

Closed.