Implement upgrade-insecure-requests in browser for frame requests

content/common/content_security_policy/csp_context.h

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
 #define CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
 
 #include <vector>
 
 #include "content/common/content_export.h"
 #include "content/common/content_security_policy/content_security_policy.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/navigation_params.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
 namespace content {
 
 struct CSPViolationParams;
 
 // A CSPContext represents the system on which the Content-Security-Policy are
 // enforced. One must define via its virtual methods how to report violations
 // and what is the set of scheme that bypass the CSP. Its main implementation
 // is in content/browser/frame_host/render_frame_host_impl.h
 class CONTENT_EXPORT CSPContext {
  public:
+  // This enum represents what set of policies should be checked by
+  // IsAllowedByCsp().
+  enum CheckCSPDisposition {
+    // Only check report-only policies.
+    CHECK_REPORT_ONLY_CSP,
+    // Only check enforced policies. (Note that enforced policies can still
+    // trigger reports.)
+    CHECK_ENFORCED_CSP,
+    // Check all policies.
+    CHECK_ALL_CSP,
+  };
+
   CSPContext();
   virtual ~CSPContext();
 
   // Check if an |url| is allowed by the set of Content-Security-Policy. It will
   // report any violation by:
   // * displaying a console message.
   // * triggering the "SecurityPolicyViolation" javascript event.
   // * sending a JSON report to any uri defined with the "report-uri" directive.
   // Returns true when the request can proceed, false otherwise.
   bool IsAllowedByCsp(CSPDirective::Name directive_name,
                       const GURL& url,
                       bool is_redirect,
-                      const SourceLocation& source_location);
+                      const SourceLocation& source_location,
+                      CheckCSPDisposition check_csp_disposition);
+
+  // Returns true if the request URL needs to be modified (e.g. upgraded to
+  // HTTPS) according to the CSP. If true, |new_url| will contain the new URL
+  // that should be used instead of |url|.
+  bool ShouldModifyRequestUrlForCsp(const GURL& url,
+                                    bool is_suresource_or_form_submssion,
+                                    GURL* new_url);
 
   void SetSelf(const url::Origin origin);
   bool AllowSelf(const GURL& url);
   bool ProtocolIsSelf(const GURL& url);
   const std::string& GetSelfScheme();
 
   virtual void ReportContentSecurityPolicyViolation(
       const CSPViolationParams& violation_params);
 
   bool SelfSchemeShouldBypassCsp();
@@ skipping 70 matching lines @@
 
   // Whether or not the violation happens after a redirect.
   bool after_redirect;
 
   // The source code location that triggered the blocked navigation.
   SourceLocation source_location;
 };
 
 }  // namespace content
 #endif  // CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_