Cross-origin https->https pings should omit Ping-From header

Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS

Committed: https://crrev.com/4d0b173423eb7a234d237fad04829ed0dd660820
Cr-Commit-Position: refs/heads/master@{#421277}

[Nate Chapin, 2016-09-21 19:01:27]

The CQ bit was checked by japhet@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-21 19:02:25]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-21 20:38:57]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-21 20:38:58]

Dry run: This issue passed the CQ dry run.

[Nate Chapin, 2016-09-21 22:27:16]

Description was changed from

==========
Cross-origin https->https pings should omit Ping-From header

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

to

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing part 4
states that a Ping-From header should only be sent for same origin requests or
if the document containing the hyperlink is unencrypted.

I haven't been able to hunt down exactly went the spec changed, but it was at
least a year ago.

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

[Nate Chapin, 2016-09-21 22:27:43]

Description was changed from

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing part 4
states that a Ping-From header should only be sent for same origin requests or
if the document containing the hyperlink is unencrypted.

I haven't been able to hunt down exactly went the spec changed, but it was at
least a year ago.

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

to

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I haven't been able to hunt down exactly went the spec
changed, but it was at least a year ago.

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

[Nate Chapin, 2016-09-21 23:14:18]

japhet@chromium.org changed reviewers:
+ mkwst@chromium.org

[Nate Chapin, 2016-09-21 23:14:19]

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/PingLoader.cpp (right):

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/PingLoader.cpp:448: if
(!pingURL.protocolIsInHTTPFamily())
I don't think this is explicitly enforced anywhere else. Relevant spec change:
https://github.com/whatwg/html/pull/1110/commits/66a87bf027d2055369381dbecd00...

[Nate Chapin, 2016-09-23 21:07:23]

Description was changed from

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I haven't been able to hunt down exactly went the spec
changed, but it was at least a year ago.

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

to

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in
https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

[Mike West, 2016-09-26 07:50:29]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2016-09-26 07:50:30]

+Jochen for the referrer policy question.

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/PingLoader.cpp (right):

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/PingLoader.cpp:448: if
(!pingURL.protocolIsInHTTPFamily())
On 2016/09/21 at 23:14:19, Nate Chapin wrote:
> I don't think this is explicitly enforced anywhere else. Relevant spec change:
https://github.com/whatwg/html/pull/1110/commits/66a87bf027d2055369381dbecd00...

Can you add a test for this as well?

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/PingLoaderTest.cpp (right):

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/PingLoaderTest.cpp:56: EXPECT_EQ(String(),
pingRequest.httpHeaderField("Ping-From"));
1. Can you copy/paste a HTTP->HTTPS test as well?

2. Does `ping-from` need to understand the page's referrer policy? /cc jochen@.

[jochen (gone - plz use gerrit), 2016-09-26 12:19:48]

On 2016/09/26 at 07:50:30, mkwst wrote:
> +Jochen for the referrer policy question.
>
> 2. Does `ping-from` need to understand the page's referrer policy? /cc
jochen@.

no

[Nate Chapin, 2016-09-26 21:17:45]

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/PingLoader.cpp (right):

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/PingLoader.cpp:448: if
(!pingURL.protocolIsInHTTPFamily())
On 2016/09/26 07:50:30, Mike West (OOO until 26th) wrote:
> On 2016/09/21 at 23:14:19, Nate Chapin wrote:
> > I don't think this is explicitly enforced anywhere else. Relevant spec
change:
>
https://github.com/whatwg/html/pull/1110/commits/66a87bf027d2055369381dbecd00...
> 
> Can you add a test for this as well?

Done.

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/loader/PingLoaderTest.cpp (right):

https://codereview.chromium.org/2360753002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/loader/PingLoaderTest.cpp:56: EXPECT_EQ(String(),
pingRequest.httpHeaderField("Ping-From"));
On 2016/09/26 07:50:30, Mike West (OOO until 26th) wrote:
> 1. Can you copy/paste a HTTP->HTTPS test as well?
> 
> 2. Does `ping-from` need to understand the page's referrer policy? /cc
jochen@.

1. Done.

2. What jochen said.

[Nate Chapin, 2016-09-26 21:17:57]

The CQ bit was checked by japhet@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 21:18:50]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 22:49:19]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 22:49:20]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Mike West, 2016-09-27 07:58:59]

LGTM. I'll argue with Jochen in
https://github.com/w3c/webappsec-referrer-policy/issues/70, but that's not
something you need to address in this patch. :)

[Nate Chapin, 2016-09-27 17:23:42]

The CQ bit was checked by japhet@chromium.org

[commit-bot: I haz the power, 2016-09-27 17:24:15]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-27 18:34:23]

Description was changed from

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in
https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

to

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in
https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

[commit-bot: I haz the power, 2016-09-27 18:34:25]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-09-27 18:38:54]

Description was changed from

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in
https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS
==========

to

==========
Cross-origin https->https pings should omit Ping-From header

https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing
part 4 states that a Ping-From header should only be sent
for same origin requests or if the document containing the
hyperlink is unencrypted.

I think this was regressed accidentally in
https://trac.webkit.org/changeset/91306

BUG=637459
TEST=PingLoaderTest.HTTPSToHTTPS

Committed: https://crrev.com/4d0b173423eb7a234d237fad04829ed0dd660820
Cr-Commit-Position: refs/heads/master@{#421277}
==========

[commit-bot: I haz the power, 2016-09-27 18:38:55]

Patchset 2 (id:??) landed as
https://crrev.com/4d0b173423eb7a234d237fad04829ed0dd660820
Cr-Commit-Position: refs/heads/master@{#421277}