`<link rel=preload>` with no `as` should be subject to connect-src

`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
Committed: https://crrev.com/33d50063a357635a3dbe9c4c880f39f2838fe0d8
Cr-Commit-Position: refs/heads/master@{#371491}

[Yoav Weiss, 2016-01-25 10:27:49]

yoav@yoav.ws changed reviewers:
+ mkwst@chromium.org

[Yoav Weiss, 2016-01-25 10:27:50]

Hey Mike :)
Can you take a look?

[Yoav Weiss, 2016-01-25 12:58:28]

On 2016/01/25 10:27:50, Yoav Weiss wrote:
> Hey Mike :)
> Can you take a look?

test failures were relevant. Fixed.

[Yoav Weiss, 2016-01-25 13:50:01]

Description was changed from

==========
Limit `<link rel=preload>` with no `as` on connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
==========

to

==========
`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
==========

[Yoav Weiss, 2016-01-25 14:35:57]

The CQ bit was checked by yoav@yoav.ws to run a CQ dry run

[commit-bot: I haz the power, 2016-01-25 14:36:11]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1632523002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1632523002/20001

[commit-bot: I haz the power, 2016-01-25 18:21:05]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-01-25 18:21:06]

Dry run: This issue passed the CQ dry run.

[Mike West, 2016-01-26 09:55:42]

LGTM. Do I need to make changes to CSP based on this? Or does the prefetch
mechanism set Fetch headers in such a way that
https://w3c.github.io/webappsec-csp/#connect-src-algorithms catches it?

[Yoav Weiss, 2016-01-26 10:03:44]

On 2016/01/26 09:55:42, Mike West wrote:
> LGTM. Do I need to make changes to CSP based on this? Or does the prefetch
> mechanism set Fetch headers in such a way that
> https://w3c.github.io/webappsec-csp/#connect-src-algorithms catches it?

Hmm, I think it would be covered by CSP if we would well-define the
"destination" part to be "subresource" in preload.
Currently it is not defined AFAICT.

[Yoav Weiss, 2016-01-26 11:25:28]

The CQ bit was checked by yoav@yoav.ws

[commit-bot: I haz the power, 2016-01-26 11:25:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1632523002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1632523002/20001

[commit-bot: I haz the power, 2016-01-26 11:30:13]

Description was changed from

==========
`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
==========

to

==========
`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
==========

[commit-bot: I haz the power, 2016-01-26 11:30:14]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-01-26 11:31:40]

Description was changed from

==========
`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758
==========

to

==========
`<link rel=preload>` with no `as` should be subject to connect-src

This CL aligns the implementation with the preload spec, so that fetches
triggered by link preload that has no `as` type, are subject to the
connect-src directive.

BUG=580758

Committed: https://crrev.com/33d50063a357635a3dbe9c4c880f39f2838fe0d8
Cr-Commit-Position: refs/heads/master@{#371491}
==========

[commit-bot: I haz the power, 2016-01-26 11:31:41]

Patchset 2 (id:??) landed as
https://crrev.com/33d50063a357635a3dbe9c4c880f39f2838fe0d8
Cr-Commit-Position: refs/heads/master@{#371491}