[webcrypto] Only allow crypto.subtle.* to be used from "secure origins".

Source/platform/weborigin/SecurityOrigin.cpp

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 357 matching lines @@
 
     if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
         return m_protocol == protocol || SecurityPolicy::isAccessToURLWhiteListed(this, url);
 
     if (SchemeRegistry::shouldTreatURLSchemeAsLocal(protocol))
         return canLoadLocalResources() || SecurityPolicy::isAccessToURLWhiteListed(this, url);
 
     return true;
 }
 
+bool SecurityOrigin::canAccessFeatureRequiringSecureOrigin() const
+{
+    if (isLocal())
+        return true;
+
+    if (SchemeRegistry::shouldTreatURLSchemeAsSecure(m_protocol))
+        return true;
+
+    // FIXME: According to http://www.chromium.org/Home/chromium-security/security-faq#TOC-Which-origins-are-secure- should match all of 127/8 and ::1/8

[palmer, 2014/05/24 01:44:30]

Should be ::1/128. Also provide a reference to
https://code.google.com/p/chromium/issues/detail?id=362214 — I'll resolve the
FIXME as part of that.

+    if (m_protocol != "" && !m_domainWasSetInDOM && (m_domain == "localhost" || m_domain == "127.0.0.1" || m_domain == "[::1]"))
+        return true;
+
+    return false;
+}
+
 SecurityOrigin::Policy SecurityOrigin::canShowNotifications() const
 {
     if (m_universalAccess)
         return AlwaysAllow;
     if (isUnique())
         return AlwaysDeny;
     return Ask;
 }
 
 void SecurityOrigin::grantLoadLocalResources()
@@ skipping 103 matching lines @@
 }
 
 const String& SecurityOrigin::urlWithUniqueSecurityOrigin()
 {
     ASSERT(isMainThread());
     DEFINE_STATIC_LOCAL(const String, uniqueSecurityOriginURL, ("data:,"));
     return uniqueSecurityOriginURL;
 }
 
 } // namespace WebCore