WIP: Move 'Upgrade-Insecure-Requests' to the browser process.

content/browser/loader/resource_dispatcher_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 
 #include <stddef.h>
 
@@ skipping 100 matching lines @@
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "ppapi/features/features.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/blob/blob_url_request_job_factory.h"
 #include "storage/browser/blob/shareable_file_reference.h"
 #include "storage/browser/fileapi/file_permission_policy.h"
 #include "storage/browser/fileapi/file_system_context.h"
+#include "third_party/WebKit/public/platform/WebInsecureRequestPolicy.h"
 #include "url/third_party/mozilla/url_parse.h"
 #include "url/url_constants.h"
 
 using base::Time;
 using base::TimeDelta;
 using base::TimeTicks;
 using storage::ShareableFileReference;
 using SyncLoadResultCallback =
     content::ResourceDispatcherHostImpl::SyncLoadResultCallback;
 
@@ skipping 1307 matching lines @@
   new_request->set_first_party_for_cookies(
       request_data.first_party_for_cookies);
 
   // The initiator should normally be present, unless this is a navigation in a
   // top-level frame. It may be null for some top-level navigations (eg:
   // browser-initiated ones).
   DCHECK(request_data.request_initiator.has_value() ||
          request_data.resource_type == RESOURCE_TYPE_MAIN_FRAME);
   new_request->set_initiator(request_data.request_initiator);
 
+  if (request_data.insecure_request_policy & blink::kUpgradeInsecureRequests) {
+    // If the initiating context wishes to upgrade insecure requests, we

[mmenke, 2016/12/15 19:24:22]

nit:  Avoid "we" in comments.  Often unclear what it means.  "We" the browser,
"We" the class, "We" the chrome developers.  May be especially confusing for
non-native speakers (x2).

+    // blanket-upgrade everything that isn't a main-frame navigation. For
+    // main-frame navigations, we blanket-upgrade form submissions, and
+    // otherwise upgrade same-host navigations.
+    //
+    // https://w3c.github.io/webappsec-upgrade-insecure-requests/#upgrade-request
+    if (request_data.resource_type != RESOURCE_TYPE_MAIN_FRAME ||
+        request_data.fetch_request_context_type == REQUEST_CONTEXT_TYPE_FORM) {
+      new_request->set_insecure_request_policy(
+          net::URLRequest::UPGRADE_ALL_INSECURE_REQUESTS);
+    } else {
+      new_request->set_insecure_request_policy(
+          net::URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS);
+    }
+  }
+
   if (request_data.originated_from_service_worker) {
     new_request->SetUserData(URLRequestServiceWorkerData::kUserDataKey,
                              new URLRequestServiceWorkerData());
   }
 
   // If the request is a MAIN_FRAME request, the first-party URL gets updated on
   // redirects.
   if (request_data.resource_type == RESOURCE_TYPE_MAIN_FRAME) {
     new_request->set_first_party_url_policy(
         net::URLRequest::UPDATE_FIRST_PARTY_URL_ON_REDIRECT);
@@ skipping 1373 matching lines @@
                                  &throttles);
     if (!throttles.empty()) {
       handler.reset(new ThrottlingResourceHandler(std::move(handler), request,
                                                   std::move(throttles)));
     }
   }
   return handler;
 }
 
 }  // namespace content