Upgrade Insecure Requests: bugfixes, tests, and support for OOPIF.

content/common/frame_messages.h

Index: content/common/frame_messages.h
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 64bf4d7a1af75a70eb37dddc37a7598a008848fa..c4dfbe36d6969799bd9df80d6e4ef03d3164d958 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -288,6 +288,7 @@ IPC_STRUCT_BEGIN_WITH_PARENT(FrameHostMsg_DidCommitProvisionalLoad_Params,
 
   // The insecure request policy the document for the load is enforcing.
   IPC_STRUCT_MEMBER(blink::WebInsecureRequestPolicy, insecure_request_policy)
+  IPC_STRUCT_MEMBER(std::vector<unsigned>, insecure_navigations_set)
 
   // True if the document for the load is a unique origin that should be
   // considered potentially trustworthy.
@@ -405,6 +406,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameReplicationState)
   IPC_STRUCT_TRAITS_MEMBER(accumulated_csp_headers)
   IPC_STRUCT_TRAITS_MEMBER(scope)
   IPC_STRUCT_TRAITS_MEMBER(insecure_request_policy)
+  IPC_STRUCT_TRAITS_MEMBER(insecure_navigations_set)
   IPC_STRUCT_TRAITS_MEMBER(has_potentially_trustworthy_unique_origin)
 IPC_STRUCT_TRAITS_END()
 
@@ -741,6 +743,11 @@ IPC_MESSAGE_ROUTED0(FrameMsg_ResetContentSecurityPolicy)
 IPC_MESSAGE_ROUTED1(FrameMsg_EnforceInsecureRequestPolicy,
                     blink::WebInsecureRequestPolicy)
 
+// Update a proxy's replicated enforcement of insecure navigations set.

[nasko, 2016/12/08 22:45:44]

nit: replicated set for enforcement of insecure navigations.

[arthursonzogni, 2016/12/09 11:06:50]

Done.

+// Used when the frame's set is changed in another process.
+IPC_MESSAGE_ROUTED1(FrameMsg_EnforceInsecureNavigationsSet,
+                    std::vector<unsigned>)
+
 // Update a proxy's replicated origin.  Used when the frame is navigated to a
 // new origin.
 IPC_MESSAGE_ROUTED2(FrameMsg_DidUpdateOrigin,
@@ -1005,6 +1012,14 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_DidAddContentSecurityPolicy,
 IPC_MESSAGE_ROUTED1(FrameHostMsg_EnforceInsecureRequestPolicy,
                     blink::WebInsecureRequestPolicy)
 
+// Sent when the frame starts enforcing an upgrade insecure navigations set.
+// Sending this information in DidCommitProvisionalLoad isn't sufficient; this
+// message is needed because, for example, a document can dynamically insert a
+// <meta> tag that causes "Upgrade Insecure Request" to be enabled and the
+// upgrade insecure navigations set to be augmented.
+IPC_MESSAGE_ROUTED1(FrameHostMsg_EnforceInsecureNavigationsSet,
+                    std::vector<unsigned>)
+
 // Sent when the frame is set to a unique origin. TODO(estark): this IPC
 // only exists to support dynamic sandboxing via a CSP delivered in a
 // <meta> tag. This is not supposed to be allowed per the CSP spec and