Mixed Content: Treat some Chrome schemes as restricting mixed content.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include "base/command_line.h"
 #include "base/debug/crash_logging.h"
 #include "base/logging.h"
 #include "base/metrics/field_trial.h"
@@ skipping 467 matching lines @@
   // resources shouldn't trigger insecure content warnings.
   WebSecurityPolicy::registerURLSchemeAsSecure(chrome_search_scheme);
 
   WebString extension_scheme(ASCIIToUTF16(extensions::kExtensionScheme));
   WebSecurityPolicy::registerURLSchemeAsSecure(extension_scheme);
 
   WebString extension_resource_scheme(
       ASCIIToUTF16(extensions::kExtensionResourceScheme));
   WebSecurityPolicy::registerURLSchemeAsSecure(extension_resource_scheme);
 
+  // chrome-search: and chrome-extension-resource: pages should not directly
+  // embed insecure resources.
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      chrome_search_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      extension_resource_scheme);
+
   // chrome:, chrome-extension:, chrome-extension-resource: resources should be
   // allowed to receive CORS requests.
   WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_scheme);
   WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_resource_scheme);
 
   // chrome-extension: resources should bypass Content Security Policy checks
   // when included in protected resources.
   WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
       extension_scheme);
   WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
@@ skipping 1155 matching lines @@
   WebString header_key(ASCIIToUTF16(
       data_reduction_proxy::chrome_proxy_header()));
   if (!response.httpHeaderField(header_key).isNull() &&
       response.httpHeaderField(header_key).utf8().find(
           data_reduction_proxy::chrome_proxy_lo_fi_directive()) !=
               std::string::npos) {
     (*properties)[data_reduction_proxy::chrome_proxy_header()] =
         data_reduction_proxy::chrome_proxy_lo_fi_directive();
   }
 }