Measure resources from private IP addresses in public websites.

Source/core/loader/MixedContentChecker.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 16 matching lines @@
  */
 
 #include "config.h"
 #include "core/loader/MixedContentChecker.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/inspector/ConsoleMessage.h"
+#include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {
 
@@ skipping 290 matching lines @@
     FrameLoaderClient* client = effectiveFrame->loader().client();
     client->didDisplayInsecureContent();
 
     String message = String::format(
         "Mixed Content: The page at '%s' was loaded over HTTPS, but contains a form whose 'action' attribute is '%s'. This form should not submit data to insecure endpoints.",
         effectiveFrame->document()->url().elidedString().utf8().data(), url.elidedString().utf8().data());
     effectiveFrame->document()->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, WarningMessageLevel, message));
     return true;
 }
 
+bool MixedContentChecker::checkMixedPrivatePublic(LocalFrame* frame, const AtomicString& resourceIPAddress)

[cbentzel, 2014/09/12 15:41:10]

return bool is not being used.

Probably want to either make it void return value, or return boolean and have
caller feed that into UseCounter rather than doing it in here.

[Mike West, 2014/09/13 04:04:33]

Dropped the bool. If/when we decide to start blocking, we can add it back.

+{
+    if (!frame || !frame->document() || !frame->document()->loader())
+        return false;
+
+    KURL documentIP(ParsedURLString, "http://" + frame->document()->loader()->response().remoteIPAddress());
+    KURL resourceIP(ParsedURLString, "http://" + resourceIPAddress);
+
+    // Just count these for the moment, don't block them.
+    //
+    // FIXME: Once we know how we want to check this, adjust the platform APIs to avoid the KURL construction.
+    if (Platform::current()->isReservedIPAddress(resourceIP) && !Platform::current()->isReservedIPAddress(documentIP)) {
+        UseCounter::count(frame->document(), UseCounter::MixedContentPrivateHostnameInPublicHostname);
+        return true;
+    }
+    return false;
+}
+
 } // namespace blink