[webcrypto] Only allow crypto.subtle.* to be used from "secure origins".

Source/platform/weborigin/SecurityOrigin.cpp

Index: Source/platform/weborigin/SecurityOrigin.cpp
diff --git a/Source/platform/weborigin/SecurityOrigin.cpp b/Source/platform/weborigin/SecurityOrigin.cpp
index 652560af325dcf8ba1f0ae4a4f97b609654b7ef5..1e14c98ae3eafcde3b6ec4cfc18e28a51d9bc40e 100644
--- a/Source/platform/weborigin/SecurityOrigin.cpp
+++ b/Source/platform/weborigin/SecurityOrigin.cpp
@@ -38,6 +38,7 @@
 #include "wtf/MainThread.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/StringBuilder.h"
+#include <url/url_canon_ip.h>

[abarth-chromium, 2014/06/10 17:09:11]

#include "url/url_canon_ip.h"

You should probably also change Source/platform/DEPS to +url so that we're being
honest about our dependencies.

[eroman, 2014/06/10 18:47:26]

Done.

 
 namespace WebCore {
 
@@ -375,6 +376,12 @@ bool SecurityOrigin::canDisplay(const KURL& url) const
     return true;
 }
 
+bool SecurityOrigin::canAccessFeatureRequiringSecureOrigin() const
+{
+    ASSERT(m_protocol != "data");
+    return isLocal() || isLocalhost() || SchemeRegistry::shouldTreatURLSchemeAsSecure(m_protocol);

[abarth-chromium, 2014/06/10 17:09:11]

We should move isLocalhost() to the end because it's the slowest.

[eroman, 2014/06/10 18:47:26]

Good point! Done.

Similarly, I moved the secure scheme check first, since that being true will be
the normal codepath.

+}
+
 SecurityOrigin::Policy SecurityOrigin::canShowNotifications() const
 {
     if (m_universalAccess)
@@ -409,6 +416,29 @@ bool SecurityOrigin::isLocal() const
     return SchemeRegistry::shouldTreatURLSchemeAsLocal(m_protocol);
 }
 
+bool SecurityOrigin::isLocalhost() const
+{
+    if (m_host == "localhost")
+        return true;
+
+    if (m_host == "[::1]")
+        return true;
+
+    // Test if m_host matches 127.0.0.1/8
+    ASSERT(m_host.containsOnlyASCII());
+    CString hostAscii = m_host.ascii();
+    Vector<uint8, 4> ipNumber;
+    ipNumber.resize(4);
+
+    int numComponents;
+    url::Component hostComponent(0, hostAscii.length());
+    url::CanonHostInfo::Family family = url::IPv4AddressToNumber(
+        hostAscii.data(), hostComponent, &(ipNumber)[0], &numComponents);
+    if (family != url::CanonHostInfo::IPV4)
+        return false;
+    return ipNumber[0] == 127;
+}
+
 String SecurityOrigin::toString() const
 {
     if (isUnique())