SRI: Remove the restriction to HTTPS documents and resources.

Source/core/frame/SubresourceIntegrity.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/SubresourceIntegrity.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
@@ skipping 69 matching lines @@
 bool SubresourceIntegrity::CheckSubresourceIntegrity(const Element& element, const String& source, const KURL& resourceUrl)
 {
     if (!RuntimeEnabledFeatures::subresourceIntegrityEnabled())
         return true;
 
     if (!element.fastHasAttribute(HTMLNames::integrityAttr))
         return true;
 
     Document& document = element.document();
 
-    // Instead of just checking SecurityOrigin::isSecure on resourceUrl, this
-    // checks canAccessFeatureRequiringSecureOrigin so that file:// protocols
-    // and localhost resources can be allowed. These may be useful for testing
-    // and are allowed for features requiring authenticated origins, so Chrome
-    // allows them here.
-    String insecureOriginMsg = "";
-    RefPtr<SecurityOrigin> resourceSecurityOrigin = SecurityOrigin::create(resourceUrl);
-    if (!document.securityOrigin()->canAccessFeatureRequiringSecureOrigin(insecureOriginMsg)) {
-        UseCounter::count(document, UseCounter::SRIElementWithIntegrityAttributeAndInsecureOrigin);

[jww, 2014/12/16 03:36:35]

If this CL eventually lands, we should deprecate these use counters.

-        // FIXME: This console message should probably utilize
-        // inesecureOriginMsg to give a more helpful message to the user.
-        logErrorToConsole("The 'integrity' attribute may only be used in documents in secure origins.", document);
-        return false;
-    }
-    if (!resourceSecurityOrigin->canAccessFeatureRequiringSecureOrigin(insecureOriginMsg)) {
-        UseCounter::count(document, UseCounter::SRIElementWithIntegrityAttributeAndInsecureResource);
-        logErrorToConsole("The 'integrity' attribute may only be used with resources on secure origins.", document);
-        return false;
-    }
-
     String integrity;
     HashAlgorithm algorithm;
     String attribute = element.fastGetAttribute(HTMLNames::integrityAttr);
     if (!parseIntegrityAttribute(attribute, integrity, algorithm, document)) {
         // An error is logged to the console during parsing; we don't need to log one here.
         UseCounter::count(document, UseCounter::SRIElementWithUnparsableIntegrityAttribute);
         return false;
     }
 
     Vector<char> hashVector;
@@ skipping 112 matching lines @@
         logErrorToConsole("Error parsing 'integrity' attribute ('" + attribute + "'). The digest must be a valid, base64-encoded value.", document);
         return false;
     }
 
     // FIXME: Parse params in order to get content type (e.g. "?ct=application/javascript")
 
     return true;
 }
 
 } // namespace blink