Block 'ftp:' subresource requests from non-'ftp:' pages.

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 778 matching lines @@
   // embedded-credential ('http://user:password@...') resources embedded as
   // subresources. in the hopes that we can block them at some point in the
   // future.
   if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) {
     DCHECK(frame()->document());
     if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) &&
         !SchemeRegistry::shouldTreatURLSchemeAsLegacy(
             frame()->document()->getSecurityOrigin()->protocol())) {
       Deprecation::countDeprecation(
           frame()->document(), UseCounter::LegacyProtocolEmbeddedAsSubresource);
+
+      // TODO(mkwst): Drop the runtime-enabled check in M59:
+      // https://www.chromestatus.com/feature/5709390967472128
+      if (RuntimeEnabledFeatures::blockLegacySubresourcesEnabled())
+        return ResourceRequestBlockedReason::Origin;
     }
     if (!url.user().isEmpty() || !url.pass().isEmpty()) {
       Deprecation::countDeprecation(
           frame()->document(),
           UseCounter::RequestedSubresourceWithEmbeddedCredentials);
     }
   }
 
   // Check for mixed content. We do this second-to-last so that when folks block
   // mixed content with a CSP policy, they don't get a warning. They'll still
@@ skipping 296 matching lines @@
                                                     response);
 }
 
 DEFINE_TRACE(FrameFetchContext) {
   visitor->trace(m_document);
   visitor->trace(m_documentLoader);
   FetchContext::trace(visitor);
 }
 
 }  // namespace blink