Add a counter for postMessage from insecure to secure top-level frames

Add a counter for postMessage from insecure to secure top-level frames

BUG=682211
R=mkwst@chromium.org

Review-Url: https://codereview.chromium.org/2651593003
Cr-Commit-Position: refs/heads/master@{#445364}
Committed: https://chromium.googlesource.com/chromium/src/+/4d512b02d6169ea3e9949297b356204fdaa30a40

[jochen (gone - plz use gerrit), 2017-01-23 08:50:05]

The CQ bit was checked by jochen@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-23 08:50:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2017-01-23 08:59:22]

https://codereview.chromium.org/2651593003/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/frame/DOMWindow.cpp (right):

https://codereview.chromium.org/2651593003/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/frame/DOMWindow.cpp:242: if
(frame()->isMainFrame()) {
That is, I think the goal of the counter is to determine how often a user would
see the UI degrade from secure to insecure; to determine that, I think you want
to figure out if the top-level frame is secure or not. That is, given a message
to `grandchild` in the tree `top -> child -> grandchild`, this new counter would
never trigger, even if `grandchild`, `child`, and `top` were all secure.

WDYT about changing this to something like `if
(MixedContentChecker::isMixedContent(frame()->tree().top()->securityContext()->getSecurityOrigin(),
sourceDocument->url()))`?

[jochen (gone - plz use gerrit), 2017-01-23 10:42:21]

done, ptal

[jochen (gone - plz use gerrit), 2017-01-23 10:42:26]

The CQ bit was checked by jochen@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-23 10:42:42]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2017-01-23 10:43:38]

LGTM

[jochen (gone - plz use gerrit), 2017-01-23 10:44:36]

The CQ bit was unchecked by jochen@chromium.org

[jochen (gone - plz use gerrit), 2017-01-23 10:44:37]

The CQ bit was checked by jochen@chromium.org

[commit-bot: I haz the power, 2017-01-23 10:44:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-23 12:34:03]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1485168277764510,
"parent_rev": "27e8f95e0a38ac53e85175b84a158da06da32eb0", "commit_rev":
"4d512b02d6169ea3e9949297b356204fdaa30a40"}

[commit-bot: I haz the power, 2017-01-23 12:34:33]

Description was changed from

==========
Add a counter for postMessage from insecure to secure top-level frames

BUG=682211
R=mkwst@chromium.org
==========

to

==========
Add a counter for postMessage from insecure to secure top-level frames

BUG=682211
R=mkwst@chromium.org

Review-Url: https://codereview.chromium.org/2651593003
Cr-Commit-Position: refs/heads/master@{#445364}
Committed:
https://chromium.googlesource.com/chromium/src/+/4d512b02d6169ea3e9949297b356...
==========

[commit-bot: I haz the power, 2017-01-23 12:34:34]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/4d512b02d6169ea3e9949297b356...