Treat reserved IP addresses as mixed content.

Source/core/loader/MixedContentChecker.cpp

Index: Source/core/loader/MixedContentChecker.cpp
diff --git a/Source/core/loader/MixedContentChecker.cpp b/Source/core/loader/MixedContentChecker.cpp
index 48ff7a77a5a2c54fbb5e5eabf39b8b4306691c1a..83bfb6de19f78f932b1afe9e41a81acfe20dbd96 100644
--- a/Source/core/loader/MixedContentChecker.cpp
+++ b/Source/core/loader/MixedContentChecker.cpp
@@ -52,6 +52,18 @@ FrameLoaderClient* MixedContentChecker::client() const
 }
 
 // static
+bool MixedContentChecker::isMixedRealm(SecurityOrigin* securityOrigin, const KURL& url)
+{
+    if (RuntimeEnabledFeatures::laxMixedContentCheckingEnabled())
+        return false;
+
+    if (securityOrigin->isReservedIPAddress())
+        return false; // We only care about public origins.
+
+    return SecurityOrigin::create(url)->isReservedIPAddress();

[abarth-chromium, 2014/08/01 18:09:45]

Why do we need to create a SecurityOrigin just to call
Platform::current()->isHostnameReservedIPAddress with the host?  I guess we need
to unpack inner URLs?

[Mike West, 2014/08/02 15:21:46]

I can skip SecurityOrigin entirely and just call the platform method here. It
seemed like something that conceptually belonged to the SecurityOrigin, like
'isSecure', but as long as this is the only callsite I'll skip that bit.

+}
+
+// static
 bool MixedContentChecker::isMixedContent(SecurityOrigin* securityOrigin, const KURL& url)
 {
     if (securityOrigin->protocol() != "https")
@@ -75,7 +87,7 @@ bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
         return false;
 
     // Then check the current frame:
-    if (!isMixedContent(securityOrigin, url))
+    if (!isMixedRealm(securityOrigin, url) && !isMixedContent(securityOrigin, url))
         return true;
 
     Settings* settings = m_frame->settings();
@@ -102,7 +114,7 @@ bool MixedContentChecker::canRunInsecureContentInternal(SecurityOrigin* security
         return false;
 
     // Then check the current frame:
-    if (!isMixedContent(securityOrigin, url))
+    if (!isMixedRealm(securityOrigin, url) && !isMixedContent(securityOrigin, url))
         return true;
 
     Settings* settings = m_frame->settings();