service worker: Don't control a subframe of an insecure context

content/browser/service_worker/service_worker_controllee_request_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_controllee_request_handler.h"
 
 #include <memory>
+#include <set>
 #include <string>
 
 #include "base/trace_event/trace_event.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_metrics.h"
 #include "content/browser/service_worker/service_worker_provider_host.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/service_worker/service_worker_response_info.h"
 #include "content/browser/service_worker/service_worker_url_request_job.h"
 #include "content/common/resource_request_body.h"
@@ skipping 188 matching lines @@
     job_->FallbackToNetwork();
     TRACE_EVENT_ASYNC_END2(
         "ServiceWorker",
         "ServiceWorkerControlleeRequestHandler::PrepareForMainResource",
         job_.get(),
         "Status", status,
         "Info", "ServiceWorker is blocked");
     return;
   }
 
+  if (!provider_host_->IsContextSecureForServiceWorker()) {
+    // TODO(falken): Figure out a way to surface in the page's DevTools
+    // console that the service worker was blocked for security.
+    job_->FallbackToNetwork();
+    TRACE_EVENT_ASYNC_END1(
+        "ServiceWorker",
+        "ServiceWorkerControlleeRequestHandler::PrepareForMainResource",
+        job_.get(), "Info", "Insecure context");
+    return;
+  }
+
   if (need_to_update) {
     force_update_started_ = true;
     context_->UpdateServiceWorker(
         registration.get(), true /* force_bypass_cache */,
         true /* skip_script_comparison */, provider_host_.get(),
         base::Bind(&self::DidUpdateRegistration, weak_factory_.GetWeakPtr(),
                    registration));
     return;
   }
 
@@ skipping 185 matching lines @@
   DCHECK(provider_host_);
   // Detach the controller so subresource requests also skip the worker.
   provider_host_->NotifyControllerLost();
 }
 
 void ServiceWorkerControlleeRequestHandler::ClearJob() {
   job_.reset();
 }
 
 }  // namespace content