Implement upgrade-insecure-requests in browser for frame requests

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 321898d1e26c18a5f03abdbd52a378983236649a..26e9edf21d374fcf6d781d178ad789d2764e077a 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -65,7 +65,6 @@
 #include "core/loader/FormSubmission.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/LinkLoader.h"
-#include "core/loader/MixedContentChecker.h"
 #include "core/loader/NavigationScheduler.h"
 #include "core/loader/NetworkHintsInterface.h"
 #include "core/loader/ProgressTracker.h"
@@ -1357,11 +1356,6 @@ NavigationPolicy FrameLoader::CheckLoadCanStart(
   RecordLatestRequiredCSP();
   // Before modifying the request, check report-only CSP headers to give the
   // site owner a chance to learn about requests that need to be modified.
-  //
-  // TODO(estark): this doesn't work with --enable-browser-side-navigation,
-  // wherein 'frame-src' is checked in the browser process. Figure out what to
-  // do; maybe with browser-side navigation the upgrade should be happening in
-  // the browser process too. See also https://crbug.com/692595
   Settings* settings = frame_->GetSettings();
   MaybeCheckCSP(
       resource_request, navigation_type, frame_, navigation_policy,
@@ -1600,6 +1594,12 @@ void FrameLoader::ModifyRequestForCSP(ResourceRequest& resource_request,
                                         "1");
   }
 
+  // PlzNavigate: Upgrading subframe requests is handled by the browser process.
+  Settings* settings = frame_->GetSettings();
+  if (resource_request.GetFrameType() == WebURLRequest::kFrameTypeNested &&
+      settings && settings->GetBrowserSideNavigationEnabled()) {

[Mike West, 2017/05/30 07:36:30]

Tiny nit: You could skip checking `settings` here if you wrapped the assignment
in an if. Like `if (Settings* settings = frame_->GetSettings())`

[estark, 2017/06/01 04:18:30]

I'll skip this one if you don't mind -- my weakling brain finds such things hard
to read. Happy to do it if you feel strongly though :)

+    return;
+  }
   UpgradeInsecureRequest(resource_request, document);
 }