CSP: Allow secure upgrade from an explicitly insecure expression.

CSP: Allow secure upgrade from an explicitly insecure expression.

This CL is a suggestion on:
https://codereview.chromium.org/2792013002/

---
Content-Security-Policy allows an url to match a source-expression even
if the scheme or the port doesn't matches, but in this case it must be
an upgrade to a more secure scheme(http->https) and more secure
port(80->443).  The problem is that it happens independently, so it is
allowed to have an upgrade of the port without the scheme (http over
443) or an upgrade of the scheme without the port (https over 80).

This is a change to force the upgrade to be both over port and scheme.
---

BUG=692499, 692442

[andypaicu, 2017-04-06 09:07:09]

andypaicu@chromium.org changed reviewers:
+ andypaicu@chromium.org

[andypaicu, 2017-04-06 14:01:16]

andypaicu@chromium.org changed reviewers:
- andypaicu@chromium.org

[arthursonzogni, 2017-04-10 11:53:26]

Description was changed from

==========
CSP: Allow secure upgrade from an explicitly insecure expression.

This CL is a suggestion on:
https://codereview.chromium.org/2792013002/

---
Content-Security-Policy allows an url to match a source-expression even
if the scheme or the port doesn't matches, but in this case it must be
an upgrade to a more secure scheme(http->https) and more secure
port(80->443).  The problem is that it happens independently, so it is
allowed to have an upgrade of the port without the scheme (http over
443) or an upgrade of the scheme without the port (https over 80).

This is a change to force the upgrade to be both over port and scheme.
---

BUG=692499, 692442
==========

to

==========
CSP: Allow secure upgrade from an explicitly insecure expression.

This CL is a suggestion on:
https://codereview.chromium.org/2792013002/

---
Content-Security-Policy allows an url to match a source-expression even
if the scheme or the port doesn't matches, but in this case it must be
an upgrade to a more secure scheme(http->https) and more secure
port(80->443).  The problem is that it happens independently, so it is
allowed to have an upgrade of the port without the scheme (http over
443) or an upgrade of the scheme without the port (https over 80).

This is a change to force the upgrade to be both over port and scheme.
---

BUG=692499, 692442
==========