WIP: Move 'Upgrade-Insecure-Requests' to the browser process.

net/url_request/url_request.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 451 matching lines @@
   DCHECK(!is_pending_);
   first_party_for_cookies_ = first_party_for_cookies;
 }
 
 void URLRequest::set_first_party_url_policy(
     FirstPartyURLPolicy first_party_url_policy) {
   DCHECK(!is_pending_);
   first_party_url_policy_ = first_party_url_policy;
 }
 
+void URLRequest::set_insecure_request_policy(
+    InsecureRequestPolicy insecure_request_policy) {
+  DCHECK(!is_pending_);
+  DCHECK(insecure_request_policy == DO_NOT_UPGRADE_INSECURE_REQUESTS ||
+         url().SchemeIsCryptographic() ||
+         (!initiator() ||

[mmenke, 2016/12/14 19:41:05]

The checks seems overly complicated...  If !initiator(), we allow HTTP requests,
even if the policy is UPGRADE_ALL_INSECURE_REQUESTS?

Should this actually be:

insecure_request_policy == UPGRADE_SAME_HOST_INSECURE_REQUESTS && (!initiator()
|| initiator()->host() != url().host())

or maybe

insecure_request_policy == UPGRADE_SAME_HOST_INSECURE_REQUESTS && (!initiator()
&& initiator()->host() != url().host()) (i.e., don't allow
UPGRADE_SAME_HOST_INSECURE_REQUESTS without an initiator, as it makes no sense)

[Mike West, 2016/12/15 07:41:18]

Yes. This was me trying to be clever about doing cheap checks first, and
screwing it up. :)

+          (insecure_request_policy == UPGRADE_SAME_HOST_INSECURE_REQUESTS &&
+           initiator()->host() != url().host())));
+  insecure_request_policy_ = insecure_request_policy;
+}
+
 void URLRequest::set_initiator(const base::Optional<url::Origin>& initiator) {
   DCHECK(!is_pending_);
   DCHECK(!initiator.has_value() || initiator.value().unique() ||
          initiator.value().GetURL().is_valid());
   initiator_ = initiator;
 }
 
 void URLRequest::set_method(const std::string& method) {
   DCHECK(!is_pending_);
   method_ = method;
@@ skipping 76 matching lines @@
                        NetworkDelegate* network_delegate)
     : context_(context),
       network_delegate_(network_delegate ? network_delegate
                                          : context->network_delegate()),
       net_log_(NetLogWithSource::Make(context->net_log(),
                                       NetLogSourceType::URL_REQUEST)),
       url_chain_(1, url),
       method_("GET"),
       referrer_policy_(CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE),
       first_party_url_policy_(NEVER_CHANGE_FIRST_PARTY_URL),
+      insecure_request_policy_(DO_NOT_UPGRADE_INSECURE_REQUESTS),
       load_flags_(LOAD_NORMAL),
       delegate_(delegate),
       status_(URLRequestStatus::FromError(OK)),
       is_pending_(false),
       is_redirecting_(false),
       redirect_limit_(kMaxRedirects),
       priority_(priority),
       identifier_(GenerateURLRequestIdentifier()),
       calling_delegate_(false),
       use_blocked_by_as_load_param_(false),
@@ skipping 636 matching lines @@
     out->clear();
 }
 
 void URLRequest::set_status(URLRequestStatus status) {
   DCHECK(status_.is_io_pending() || status_.is_success() ||
          (!status.is_success() && !status.is_io_pending()));
   status_ = status;
 }
 
 }  // namespace net