Limit foreign fetch to only intercept requests made from secure contexts.

content/browser/service_worker/foreign_fetch_request_handler.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/foreign_fetch_request_handler.h"
 
 #include <string>
 
 #include "base/macros.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
@@ skipping 40 matching lines @@
     storage::BlobStorageContext* blob_storage_context,
     int process_id,
     int provider_id,
     bool skip_service_worker,
     FetchRequestMode request_mode,
     FetchCredentialsMode credentials_mode,
     FetchRedirectMode redirect_mode,
     ResourceType resource_type,
     RequestContextType request_context_type,
     RequestContextFrameType frame_type,
-    scoped_refptr<ResourceRequestBody> body) {
+    scoped_refptr<ResourceRequestBody> body,
+    bool initiated_in_secure_context) {
   if (!context_wrapper) {
     return;
   }
 
+  if (!initiated_in_secure_context)
+    return;
+
   if (!context_wrapper->OriginHasForeignFetchRegistrations(
           request->url().GetOrigin())) {
     return;
   }
 
   if (request->initiator().IsSameOriginWith(url::Origin(request->url())))
     return;
+
   if (ServiceWorkerUtils::IsMainResourceType(resource_type))
     return;
 
   // Any more precise checks to see if the request should be intercepted are
   // asynchronous, so just create our handler in all cases.
   std::unique_ptr<ForeignFetchRequestHandler> handler(
       new ForeignFetchRequestHandler(
           context_wrapper, blob_storage_context->AsWeakPtr(), request_mode,
           credentials_mode, redirect_mode, resource_type, request_context_type,
           frame_type, body));
@@ skipping 138 matching lines @@
   }
   return target_worker_.get();
 }
 
 void ForeignFetchRequestHandler::ClearJob() {
   job_.reset();
   target_worker_ = nullptr;
 }
 
 }  // namespace content