[Merge M-57] Display "Not secure" verbose state for data: URLs

components/security_state/core/security_state.cc

Index: components/security_state/core/security_state.cc
diff --git a/components/security_state/core/security_state.cc b/components/security_state/core/security_state.cc
index d5e867ed6de8ae7ea425a6ac330887c8a8ac19c3..b818c8aee801b4907a76a92a2e2c15afc42f455d 100644
--- a/components/security_state/core/security_state.cc
+++ b/components/security_state/core/security_state.cc
@@ -124,6 +124,12 @@ SecurityLevel GetSecurityLevelForRequest(
     return DANGEROUS;
   }
 
+  // data: URLs don't define a secure context, and are a vector for spoofing.
+  // Display a "Not secure" badge for all data URLs, regardless of whether
+  // they show a password or credit card field.
+  if (url.SchemeIs(url::kDataScheme))
+    return SecurityLevel::HTTP_SHOW_WARNING;
+
   // Choose the appropriate security level for HTTP requests.
   if (!is_cryptographic_with_certificate) {
     if (!is_origin_secure_callback.Run(url) && url.IsStandard()) {