[webcrypto] Only allow crypto.subtle.* to be used from "secure origins".

Source/platform/weborigin/SecurityOriginTest.cpp

Index: Source/platform/weborigin/SecurityOriginTest.cpp
diff --git a/Source/platform/weborigin/SecurityOriginTest.cpp b/Source/platform/weborigin/SecurityOriginTest.cpp
index 90f5c93618152c965560d27816469ea16693becf..267bde7dd0a0b51c0ca0db388fe62c8eec200d74 100644
--- a/Source/platform/weborigin/SecurityOriginTest.cpp
+++ b/Source/platform/weborigin/SecurityOriginTest.cpp
@@ -60,5 +60,51 @@ TEST(SecurityOriginTest, ValidPortsCreateNonUniqueOrigins)
     }
 }
 
+TEST(SecurityOriginTest, CanAccessFeatureRequringSecureOrigin)
+{
+    struct TestCase {
+        bool accessGranted;
+        const char* url;
+    };
+
+    TestCase inputs[] = {
+        // Access is granted to webservers running on localhost.
+        { true, "http://localhost" },
+        { true, "http://localhost:100" },
+        { true, "http://127.0.0.1" },
+        { true, "http://[::1]" },
+        { true, "http://[::1]:21" },
+        { true, "http://127.0.0.1:8080" },
+        { true, "ftp://127.0.0.1" },
+        { true, "ftp://127.0.0.1:443" },
+        { true, "ws://127.0.0.1" },
+
+        // Access is granted to all secure transports.

[darin (slow to review), 2014/05/29 05:08:14]

What about blob URLs generated from https:// pages? Suppose I coin a Blob from
my https:// page, and then navigate an iframe to the URL of the Blob. Is the
resulting document granted access? I think it should be.

Ditto for filesystem: URLs.

+        { true, "https://foobar.com" },
+        { true, "wss://foobar.com" },
+
+        // Access is denied to insecure transports.
+        { false, "ftp://foobar.com" },
+        { false, "http://foobar.com" },
+        { false, "http://foobar.com:443" },
+        { false, "ws://foobar.com" },
+        { false, "data:text/html;charset=utf-8;base64,PHNjcmlwdD5hbGVydCgnaGkhJyk8L3NjcmlwdD4=" },
+        { false, "javascript:alert('hi')" },
+
+        // Access is granted to local files
+        { true, "file:///home/foobar/index.html" },
+    };
+
+    for (size_t i = 0; i < ARRAYSIZE_UNSAFE(inputs); ++i) {
+        SCOPED_TRACE(i);
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(inputs[i].url);
+        EXPECT_EQ(inputs[i].accessGranted, origin->canAccessFeatureRequiringSecureOrigin());
+    }
+
+    // Unique origins are not considered secure.
+    RefPtr<SecurityOrigin> uniqueOrigin = SecurityOrigin::createUnique();
+    EXPECT_FALSE(uniqueOrigin->canAccessFeatureRequiringSecureOrigin());
+}
+
 } // namespace