[ServiceWorker] Block all mixed-content requests from a ServiceWorker.

Source/web/WebEmbeddedWorkerImpl.cpp

Index: Source/web/WebEmbeddedWorkerImpl.cpp
diff --git a/Source/web/WebEmbeddedWorkerImpl.cpp b/Source/web/WebEmbeddedWorkerImpl.cpp
index 7cf39743ea2185cfe67f99be57f5f2cedba531aa..04083c122948b97f2e4385a562341954d9692b9e 100644
--- a/Source/web/WebEmbeddedWorkerImpl.cpp
+++ b/Source/web/WebEmbeddedWorkerImpl.cpp
@@ -304,9 +304,16 @@ void WebEmbeddedWorkerImpl::prepareShadowPageForLoader()
     // with SharedWorker.
     ASSERT(!m_webView);
     m_webView = WebView::create(0);
+    WebSettings* settings = m_webView->settings();
     // FIXME: http://crbug.com/363843. This needs to find a better way to
     // not create graphics layers.
-    m_webView->settings()->setAcceleratedCompositingEnabled(false);
+    settings->setAcceleratedCompositingEnabled(false);
+    // Currently we block all mixed-content requests from a ServiceWorker.
+    // FIXME: When we support FetchEvent.default(), we should relax this
+    // restriction.
+    settings->setStrictMixedContentChecking(true);

[Mike West, 2015/01/26 10:04:53]

This settings object only takes effect for this worker, right? I assume we throw
the webview away after the worker is destructed, and don't use it for any
page-level security checks?

[horo, 2015/01/26 11:17:14]

Yes. This WebView is only used for the resource loading requests from the
ServiceWorker.

+    settings->setAllowDisplayOfInsecureContent(false);
+    settings->setAllowRunningOfInsecureContent(false);

[Mike West, 2015/01/26 10:04:53]

Setting strict mode will stop notifications up to the frame client; that might
or might not be what you want. It will prevent UI degradation, but it will also
prevent the mixed content shield icon from showing up for user override, and
will stop any browser-side UMA measurement.

As long as everything mixed-content-related that you want to measure happens on
the blink side, that's fine, but it's something to consider.

[horo, 2015/01/26 11:17:14]

We discussed with rsleevi@ and decided to block all mixed-content requests from
ServiceWorkers for M42.
This ensures that the ServiceWorker will not touch any HTTP responses.

And for M43, we will implement the browser side buffering for No-CORS
mixed-content requests.
https://docs.google.com/document/d/1y6X8rVhkP_fQeC2awsG8mSCVTorw9FLniOncVLtT1...

     m_mainFrame = WebLocalFrame::create(this);
     m_webView->setMainFrame(m_mainFrame);
     m_webView->setDevToolsAgentClient(this);