Treat reserved IP addresses as mixed content.

Source/core/loader/MixedContentChecker.cpp

Index: Source/core/loader/MixedContentChecker.cpp
diff --git a/Source/core/loader/MixedContentChecker.cpp b/Source/core/loader/MixedContentChecker.cpp
index 48ff7a77a5a2c54fbb5e5eabf39b8b4306691c1a..c70781d9ef589993ce96139f26904076903e9d18 100644
--- a/Source/core/loader/MixedContentChecker.cpp
+++ b/Source/core/loader/MixedContentChecker.cpp
@@ -37,6 +37,8 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
+#include "public/platform/Platform.h"
+#include "public/platform/WebURL.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {
@@ -52,6 +54,22 @@ FrameLoaderClient* MixedContentChecker::client() const
 }
 
 // static
+bool MixedContentChecker::isMixedRealm(SecurityOrigin* securityOrigin, const KURL& url)
+{
+    if (RuntimeEnabledFeatures::laxMixedContentCheckingEnabled())
+        return false;
+
+    // We only care about public origins: private origins can load public resources without issue.
+    KURL originURL;
+    originURL.setProtocol(securityOrigin->protocol());
+    originURL.setHost(securityOrigin->host());
+    if (!Platform::current()->isReservedIPAddress(originURL))

[Mike West, 2014/08/06 09:08:14]

I would like to pass the SecurityOrigin to the platform layer directly. But I
can't because layering. :(

+        return false;
+
+    return Platform::current()->isReservedIPAddress(url);
+}
+
+// static
 bool MixedContentChecker::isMixedContent(SecurityOrigin* securityOrigin, const KURL& url)
 {
     if (securityOrigin->protocol() != "https")
@@ -75,7 +93,7 @@ bool MixedContentChecker::canDisplayInsecureContentInternal(SecurityOrigin* secu
         return false;
 
     // Then check the current frame:
-    if (!isMixedContent(securityOrigin, url))
+    if (!isMixedContent(securityOrigin, url) && !isMixedRealm(securityOrigin, url))
         return true;
 
     Settings* settings = m_frame->settings();
@@ -102,7 +120,7 @@ bool MixedContentChecker::canRunInsecureContentInternal(SecurityOrigin* security
         return false;
 
     // Then check the current frame:
-    if (!isMixedContent(securityOrigin, url))
+    if (!isMixedContent(securityOrigin, url) && !isMixedRealm(securityOrigin, url))
         return true;
 
     Settings* settings = m_frame->settings();