Limit foreign fetch to only intercept requests made from secure contexts.

content/browser/service_worker/foreign_fetch_request_handler.cc

Index: content/browser/service_worker/foreign_fetch_request_handler.cc
diff --git a/content/browser/service_worker/foreign_fetch_request_handler.cc b/content/browser/service_worker/foreign_fetch_request_handler.cc
index 59fe4846dfdedca40e239a131337244232f20f80..c712064a0b839da17636abf67ff3286bda5f20c7 100644
--- a/content/browser/service_worker/foreign_fetch_request_handler.cc
+++ b/content/browser/service_worker/foreign_fetch_request_handler.cc
@@ -58,11 +58,15 @@ void ForeignFetchRequestHandler::InitializeHandler(
     ResourceType resource_type,
     RequestContextType request_context_type,
     RequestContextFrameType frame_type,
-    scoped_refptr<ResourceRequestBody> body) {
+    scoped_refptr<ResourceRequestBody> body,
+    bool initiated_in_secure_context) {
   if (!context_wrapper) {
     return;
   }
 
+  if (!initiated_in_secure_context)
+    return;

[kinuko, 2016/06/03 09:17:16]

This makes me feel if we should just skip calling InitializeHandler if this is
false in resource_dispatcher_host_impl... any reason we don't do that?

[Marijn Kruisselbrink, 2016/06/06 19:23:34]

No particular reason, other than keeping all the checks in one place. Similarly
ResourceDispatcherHost could skip calling InitializeHandler (and
ServiceWorkerRequestHandler::InitializeHandler) when context_wrapper is null,
and for a few other checks that InitializeHandler does. So it's mostly a
question of how much you want ResourceDispatcherHost to know about service
worker specific checks.
(also in a future (still very much WIP) patch I'm working on to limit which
requests we process Link rel=serviceworker HTTP response headers for the same
initiated_in_secure_context flag is used for that as well, so ResourceDH won't
be just passing the flag on to InitializeHandler anymore then:
https://codereview.chromium.org/1914593002)

[kinuko, 2016/06/07 06:55:57]

Ah ok, makes sense.  Yeah having decision related logic here would be probably
better.

+
   if (!context_wrapper->OriginHasForeignFetchRegistrations(
           request->url().GetOrigin())) {
     return;
@@ -70,6 +74,7 @@ void ForeignFetchRequestHandler::InitializeHandler(
 
   if (request->initiator().IsSameOriginWith(url::Origin(request->url())))
     return;
+
   if (ServiceWorkerUtils::IsMainResourceType(resource_type))
     return;