Block mixed <picture> and <img srcset> by default.

Block mixed <picture> and <img srcset> by default.

It's going to be more or less impossible to begin blocking mixed <img>
content by default, given the amount of usage we're likely to see in the
wild (I'm still waiting for metrics from Chrome stable, but I'm not
hopeful). I think it will be significantly less impossible to avoid the
same mistake with the new responsive hotness.

This CL treats <picture> and <img srcset> as active content, blocking
them by default when mixed.

BUG=390158
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=177385

[Mike West, 2014-06-30 14:14:21]

Hey Yoav, is this a sane implementation?

I'm not going to try to land this until the discussion at
http://lists.w3.org/Archives/Public/public-webappsec/2014Jun/0245.html goes
somewhere, but this is the PoC I'm playing with at the moment.

-mike

[Yoav Weiss, 2014-06-30 15:18:25]

On 2014/06/30 14:14:21, Mike West wrote:
> Hey Yoav, is this a sane implementation?
> 
> I'm not going to try to land this until the discussion at
> http://lists.w3.org/Archives/Public/public-webappsec/2014Jun/0245.html goes
> somewhere, but this is the PoC I'm playing with at the moment.
> 
> -mike

LGTM! :)

[Mike West, 2014-07-01 12:42:22]

WDYT, Tom? Is this something we should try? I think it is. :)

-mike

[Tom Sepez, 2014-07-01 17:20:49]

I think this aligns with the principle that new features should be secure by
default. +palmer.

[Mike West, 2014-07-02 10:44:25]

On 2014/07/01 17:20:49, Tom Sepez wrote:
> I think this aligns with the principle that new features should be secure by
> default. +palmer.

Chris is out this week... Based on discussion in the webappsec WG[1] and
responsiveimages CG[2], I'm going to land this. If it turns out to be a terrible
idea, I'll revert it. :)

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jun/0245.html
[2]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jul/0008.html

[Mike West, 2014-07-02 10:44:28]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2014-07-02 10:45:32]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/mkwst@chromium.org/356243003/20001

[commit-bot: I haz the power, 2014-07-02 13:31:39]

Change committed as 177385