Mixed Content: Treat some Chrome schemes as restricting mixed content.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include "base/command_line.h"
 #include "base/debug/crash_logging.h"
 #include "base/logging.h"
 #include "base/metrics/field_trial.h"
@@ skipping 385 matching lines @@
   WebSecurityPolicy::registerURLSchemeAsLocal(external_file_scheme);
 #endif
 
   // chrome: and chrome-search: pages should not be accessible by bookmarklets
   // or javascript: URLs typed in the omnibox.
   WebSecurityPolicy::registerURLSchemeAsNotAllowingJavascriptURLs(
       chrome_ui_scheme);
   WebSecurityPolicy::registerURLSchemeAsNotAllowingJavascriptURLs(
       chrome_search_scheme);
 
-  // chrome:, chrome-search:, chrome-extension:, and chrome-extension-resource:
-  // resources shouldn't trigger insecure content warnings.
+  // chrome:, chrome-search:, chrome-extension:, chrome-extension-resource:,
+  // and chrome-devtools: resources shouldn't trigger insecure content
+  // warnings when embedded in pages whose schemes are registered as
+  // restricting mixed content.
   WebSecurityPolicy::registerURLSchemeAsSecure(chrome_ui_scheme);
   WebSecurityPolicy::registerURLSchemeAsSecure(chrome_search_scheme);
 
   WebString extension_scheme(ASCIIToUTF16(extensions::kExtensionScheme));
   WebSecurityPolicy::registerURLSchemeAsSecure(extension_scheme);
 
   WebString extension_resource_scheme(
       ASCIIToUTF16(extensions::kExtensionResourceScheme));
   WebSecurityPolicy::registerURLSchemeAsSecure(extension_resource_scheme);
+  WebSecurityPolicy::registerURLSchemeAsSecure(dev_tools_scheme);
+
+  // chrome:, chrome-search:, chrome-extension-resource:, and chrome-devtools:
+  // pages should not directly embed insecure resources.

[jochen (gone - plz use gerrit), 2015/05/18 22:48:40]

chrome: and chrome-devtools: are defined in content. I wonder whether we should
register them there?

+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      chrome_ui_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      chrome_search_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      dev_tools_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      extension_resource_scheme);

[not at google - send to devlin, 2015/05/18 23:08:33]

Double-check with the ARC people about this, they're the main clients of
chrome-extension-resource.

[elijahtaylor1, 2015/05/18 23:46:33]

I don't think this should be a problem for ARC. We actually don't use
chrome-extension-resource, shared module resources are delivered via reserved
_modules/ paths from the normal chrome-extension:// scheme.

 
   // chrome:, chrome-extension:, chrome-extension-resource: resources should be
   // allowed to receive CORS requests.
   WebSecurityPolicy::registerURLSchemeAsCORSEnabled(chrome_ui_scheme);
   WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_scheme);
   WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_resource_scheme);
 
   // chrome-extension: resources should bypass Content Security Policy checks
   // when included in protected resources.
   WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
@@ skipping 1146 matching lines @@
   if (mime_type == content::kBrowserPluginMimeType) {
     return new extensions::ExtensionsGuestViewContainer(render_frame);
   } else {
     return new extensions::MimeHandlerViewContainer(
         render_frame, mime_type, original_url);
   }
 #else
   return NULL;
 #endif
 }