CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/fetch/ResourceFetcher.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 48 matching lines @@
 #include "core/loader/PingLoader.h"
 #include "core/loader/SubstituteData.h"
 #include "core/loader/UniqueIdentifier.h"
 #include "core/loader/appcache/ApplicationCacheHost.h"
 #include "core/timing/Performance.h"
 #include "core/timing/ResourceTimingInfo.h"
 #include "core/svg/graphics/SVGImageChromeClient.h"
 #include "platform/Logging.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/TraceEvent.h"
+#include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLRequest.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/WTFString.h"
 
 #define PRELOAD_DEBUG 0
@@ skipping 631 matching lines @@
 }
 
 ResourcePtr<Resource> ResourceFetcher::requestResource(Resource::Type type, FetchRequest& request)
 {
     ASSERT(request.options().synchronousPolicy == RequestAsynchronously || type == Resource::Raw);
 
     TRACE_EVENT0("blink", "ResourceFetcher::requestResource");
 
     KURL url = request.resourceRequest().url();
 
+    if (m_document && m_document->insecureContentPolicy() == SecurityContext::InsecureContentUpgrade && url.protocol() == "http") {
+        url.setProtocol("https");
+        // FIXME: HACKY HACKY HACKY HACKY.
+        if (url.port() == 8000 || url.port() == 8080)
+            url.setPort(8443);

[Mike West, 2015/02/05 12:35:01]

:(

I think we need some sort of platform API that allows the embedder to give us
the default port (which we can override in layouttests), rather than relying on
KnownPorts.h in Blink.

WDYT of that approach?

+        else if (url.port() == 80)
+            url.setPort(443);

[Yoav Weiss, 2015/02/05 13:25:36]

What happens if the port is neither one of those? Do we send https traffic on
the same original port and hope for the best?

[Mike West, 2015/02/05 13:39:34]

Yup. Same as HSTS. See the comment I just added to the spec in step 8 of
https://w3c.github.io/webappsec/specs/upgrade/#upgrade-request.

+        request.mutableResourceRequest().setURL(url);
+    }
+
     WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource '%s', charset '%s', priority=%d, forPreload=%u, type=%s", url.elidedString().latin1().data(), request.charset().latin1().data(), request.priority(), request.forPreload(), ResourceTypeName(type));
 
     // If only the fragment identifiers differ, it is the same resource.
     url = MemoryCache::removeFragmentIdentifierIfNeeded(url);
 
     if (!url.isValid())
         return nullptr;
 
     if (!canRequest(type, request.resourceRequest(), url, request.options(), request.forPreload(), request.originRestriction()))
         return nullptr;
@@ skipping 849 matching lines @@
 
 void ResourceFetcher::trace(Visitor* visitor)
 {
     visitor->trace(m_document);
     visitor->trace(m_loaders);
     visitor->trace(m_nonBlockingLoaders);
     ResourceLoaderHost::trace(visitor);
 }
 
 }