Mixed Content: Treat some Chrome schemes as restricting mixed content.

chrome/renderer/chrome_content_renderer_client.cc

Index: chrome/renderer/chrome_content_renderer_client.cc
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index 79bc401e1934d29c26f97a5724ef645b89341508..070e8cf3a90b3223c116923f8e73e4186de379c9 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -403,8 +403,10 @@ void ChromeContentRendererClient::RenderThreadStarted() {
   WebSecurityPolicy::registerURLSchemeAsNotAllowingJavascriptURLs(
       chrome_search_scheme);
 
-  // chrome:, chrome-search:, chrome-extension:, and chrome-extension-resource:
-  // resources shouldn't trigger insecure content warnings.
+  // chrome:, chrome-search:, chrome-extension:, chrome-extension-resource:,
+  // and chrome-devtools: resources shouldn't trigger insecure content
+  // warnings when embedded in pages whose schemes are registered as
+  // restricting mixed content.
   WebSecurityPolicy::registerURLSchemeAsSecure(chrome_ui_scheme);
   WebSecurityPolicy::registerURLSchemeAsSecure(chrome_search_scheme);
 
@@ -414,6 +416,18 @@ void ChromeContentRendererClient::RenderThreadStarted() {
   WebString extension_resource_scheme(
       ASCIIToUTF16(extensions::kExtensionResourceScheme));
   WebSecurityPolicy::registerURLSchemeAsSecure(extension_resource_scheme);
+  WebSecurityPolicy::registerURLSchemeAsSecure(dev_tools_scheme);
+
+  // chrome:, chrome-search:, chrome-extension-resource:, and chrome-devtools:
+  // pages should not directly embed insecure resources.

[jochen (gone - plz use gerrit), 2015/05/18 22:48:40]

chrome: and chrome-devtools: are defined in content. I wonder whether we should
register them there?

+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      chrome_ui_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      chrome_search_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      dev_tools_scheme);
+  WebSecurityPolicy::registerURLSchemeAsRestrictingMixedContent(
+      extension_resource_scheme);

[not at google - send to devlin, 2015/05/18 23:08:33]

Double-check with the ARC people about this, they're the main clients of
chrome-extension-resource.

[elijahtaylor1, 2015/05/18 23:46:33]

I don't think this should be a problem for ARC. We actually don't use
chrome-extension-resource, shared module resources are delivered via reserved
_modules/ paths from the normal chrome-extension:// scheme.

 
   // chrome:, chrome-extension:, chrome-extension-resource: resources should be
   // allowed to receive CORS requests.