Prevent mixed content iframes on back/forward.

Prevent mixed content iframes on back/forward.

BUG=625349
TEST=See bug comment 3 for repro steps.

Committed: https://crrev.com/1909e832326794bd74265f93d32407aeeb131253
Cr-Commit-Position: refs/heads/master@{#409258}

[Charlie Reis, 2016-08-01 22:18:07]

The CQ bit was checked by creis@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-01 22:18:31]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Charlie Reis, 2016-08-01 23:39:15]

creis@chromium.org changed reviewers:
+ japhet@chromium.org, mkwst@chromium.org

[Charlie Reis, 2016-08-01 23:39:17]

Mike, can you comment on whether RequestContextInternal is safe to make
Blockable?  The bots seem to be happy with it, but that may just mean we don't
have tests for what it would break.

Nate, are you ok with removing the old fix in FrameLoader and putting the
blocked frame in history?

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/LayoutTe...
File
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-iframe-in-main-frame-expected.txt
(right):

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/LayoutTe...
third_party/WebKit/LayoutTests/http/tests/security/mixedContent/insecure-iframe-in-main-frame-expected.txt:10:
http://example.test:8080/security/mixedContent/resources/boring.html (in frame
"<!--framePath //<!--frame0-->-->")
This frame should show up now that we're not artificially excluding it from
history.  That seems like the right thing to do.

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/FrameLoader.cpp (left):

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/FrameLoader.cpp:435: historyCommitType =
HistoryInertCommit;
This reverts the fix for https://crbug.com/348952, given the issues I noted in
https://crbug.com625349/#c3.

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/MixedContentChecker.cpp (right):

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/MixedContentChecker.cpp:207: ",
requestContext: " << requestContext;
Ignore all these DLOGs-- I'll remove them before we land anything.

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/p...
File third_party/WebKit/Source/platform/exported/WebMixedContent.cpp (right):

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/p...
third_party/WebKit/Source/platform/exported/WebMixedContent.cpp:64: case
WebURLRequest::RequestContextInternal:
Is this safe?

[commit-bot: I haz the power, 2016-08-01 23:59:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-01 23:59:15]

Dry run: This issue passed the CQ dry run.

[Mike West, 2016-08-02 07:41:51]

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/p...
File third_party/WebKit/Source/platform/exported/WebMixedContent.cpp (right):

https://codereview.chromium.org/2198933003/diff/1/third_party/WebKit/Source/p...
third_party/WebKit/Source/platform/exported/WebMixedContent.cpp:64: case
WebURLRequest::RequestContextInternal:
On 2016/08/01 at 23:39:16, Charlie Reis wrote:
> Is this safe?

I wouldn't have thought so, though it surprises me that all the tests pass.
"Internal" was more or less a dumping ground for all the kinds of requests that
got missed when we made an initial pass through the codebase to tag requests
with contextual information. If we _can_ make this change, we should, as it's a
safer default. Jochen likes to say "No test, no feature." I'm inclined to agree.
:) 

I agree with your assessment of the rest. LGTM % logging cruft. :)

[Nate Chapin, 2016-08-02 16:52:24]

If mkwst and the bots are happy, I'm happy. LGTM

[Charlie Reis, 2016-08-02 17:31:06]

The CQ bit was checked by creis@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-02 17:31:43]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Charlie Reis, 2016-08-02 18:09:43]

creis@chromium.org changed reviewers:
+ lukasza@chromium.org

[Charlie Reis, 2016-08-02 18:09:43]

Great, I'll give it a try.

Lukasz, can you review the test filter files?  I'm not re-enabling it for
--site-per-process yet because the test is still failing there.  I'll look into
that separately.

[Łukasz Anforowicz, 2016-08-02 18:12:09]

On 2016/08/02 18:09:43, Charlie Reis wrote:
> Great, I'll give it a try.
> 
> Lukasz, can you review the test filter files?  I'm not re-enabling it for
> --site-per-process yet because the test is still failing there.  I'll look
into
> that separately.

third_party/WebKit/LayoutTests changes lgtm

[Charlie Reis, 2016-08-02 18:21:17]

The CQ bit was unchecked by creis@chromium.org

[Charlie Reis, 2016-08-02 18:21:21]

The CQ bit was checked by creis@chromium.org

[Charlie Reis, 2016-08-02 18:21:22]

The patchset sent to the CQ was uploaded after l-g-t-m from japhet@chromium.org,
mkwst@chromium.org
Link to the patchset: https://codereview.chromium.org/2198933003/#ps20001
(title: "Re-enable tess")

[commit-bot: I haz the power, 2016-08-02 18:21:53]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-02 18:56:12]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-08-02 19:00:51]

Description was changed from

==========
Prevent mixed content iframes on back/forward.

BUG=625349
TEST=See bug comment 3 for repro steps.
==========

to

==========
Prevent mixed content iframes on back/forward.

BUG=625349
TEST=See bug comment 3 for repro steps.

Committed: https://crrev.com/1909e832326794bd74265f93d32407aeeb131253
Cr-Commit-Position: refs/heads/master@{#409258}
==========

[commit-bot: I haz the power, 2016-08-02 19:00:53]

Patchset 2 (id:??) landed as
https://crrev.com/1909e832326794bd74265f93d32407aeeb131253
Cr-Commit-Position: refs/heads/master@{#409258}