Implementing mixed content for forms posting to insecure location from secure ones

Source/core/html/HTMLFormElement.h

Index: Source/core/html/HTMLFormElement.h
diff --git a/Source/core/html/HTMLFormElement.h b/Source/core/html/HTMLFormElement.h
index d0db27f98514b7c8216f5a0b2486d84fbe103094..bf8fba7a6b57ba3bb3a5461d28ef2ad273d4a11b 100644
--- a/Source/core/html/HTMLFormElement.h
+++ b/Source/core/html/HTMLFormElement.h
@@ -118,6 +118,9 @@ public:
 
     void anonymousNamedGetter(const AtomicString& name, bool&, RefPtrWillBeRawPtr<RadioNodeList>&, bool&, RefPtrWillBeRawPtr<Element>&);
 
+protected:
+    virtual void attributeChanged(const QualifiedName&, const AtomicString&, AttributeModificationReason = ModifiedDirectly) OVERRIDE;
+
 private:
     explicit HTMLFormElement(Document&);
 
@@ -182,6 +185,11 @@ private:
     bool m_wasDemoted;
 
     OwnPtr<GenericEventQueue> m_pendingAutocompleteEventsQueue;
+
+    KURL getActionURL() const

[Mike West, 2014/06/06 12:18:18]

We're only using this in the method you introduced, correct? If so, let's not
add to the external signature. I'd prefer to see you implement this as a static
method in the .cc file.

[mhm, 2014/06/06 19:11:59]

Done.

+    {
+        return document().completeURL(m_attributes.action().isEmpty() ? document().url().string() : m_attributes.action());

[Mike West, 2014/06/06 12:18:18]

Why convert the document's URL into a string, and then convert it into a URL?
Just return the document's URL if `action` is empty, and call `completeURL` on
the attribute if it's not empty.

(Sorry. I should have mentioned both of these in the initial review. I didn't
pay enough attention at the time.)

[mhm, 2014/06/06 19:11:59]

Done.

+    }
 };
 
 } // namespace WebCore