Don't allow FTP requests to HSTS-enabled domains.

net/url_request/ftp_protocol_handler.cc

Index: net/url_request/ftp_protocol_handler.cc
diff --git a/net/url_request/ftp_protocol_handler.cc b/net/url_request/ftp_protocol_handler.cc
index 4c10124ceed561394fb91791304affe231f7b684..237a2b568fc1bbf8eaf86a9decee845dc950e306 100644
--- a/net/url_request/ftp_protocol_handler.cc
+++ b/net/url_request/ftp_protocol_handler.cc
@@ -8,7 +8,9 @@
 #include "net/base/net_errors.h"
 #include "net/base/port_util.h"
 #include "net/ftp/ftp_auth_cache.h"
+#include "net/http/transport_security_state.h"
 #include "net/url_request/url_request.h"
+#include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_error_job.h"
 #include "net/url_request/url_request_ftp_job.h"
 #include "url/gurl.h"
@@ -34,6 +36,13 @@ URLRequestJob* FtpProtocolHandler::MaybeCreateJob(
     return new URLRequestErrorJob(request, network_delegate, ERR_UNSAFE_PORT);
   }
 
+  TransportSecurityState* state =
+      request->context()->transport_security_state();
+  if (state && state->ShouldUpgradeToSSL(request->url().host())) {
+    return new URLRequestErrorJob(request, network_delegate,
+                                  ERR_DISALLOWED_URL_SCHEME);
+  }
+
   return new URLRequestFtpJob(request,
                               network_delegate,
                               ftp_transaction_factory_,