CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
+#include "core/dom/SecurityContext.h"
 #include "core/frame/LocalFrame.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "platform/Crypto.h"
 #include "platform/ParsingUtilities.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
 #include "wtf/text/Base64.h"
 #include "wtf/text/StringUTF8Adaptor.h"
 #include "wtf/text/WTFString.h"
@@ skipping 21 matching lines @@
 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
     : m_policy(policy)
     , m_headerType(type)
     , m_headerSource(source)
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
     , m_reflectedXSSDisposition(ReflectedXSSUnset)
     , m_didSetReferrerPolicy(false)
     , m_referrerPolicy(ReferrerPolicyDefault)
     , m_strictMixedContentCheckingEnforced(false)
+    , m_upgradeInsecureContent(false)
 {
     m_reportOnly = type == ContentSecurityPolicyHeaderTypeReport;
 }
 
 PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
 {
     OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy, type, source));
     directives->parse(begin, end);
 
     if (!directives->checkEval(directives->operativeDirective(directives->m_scriptSrc.get()))) {
@@ skipping 510 matching lines @@
     if (m_strictMixedContentCheckingEnforced) {
         m_policy->reportDuplicateDirective(name);
         return;
     }
     m_strictMixedContentCheckingEnforced = true;
     m_policy->enforceStrictMixedContentChecking();
     if (!value.isEmpty())
         m_policy->reportValueForEmptyDirective(name, value);
 }
 
+void CSPDirectiveList::enableInsecureContentUpgrade(const String& name, const String& value)
+{
+    if (m_upgradeInsecureContent) {
+        m_policy->reportDuplicateDirective(name);
+        return;
+    }
+    m_upgradeInsecureContent = true;
+    m_policy->setInsecureContentPolicy(m_reportOnly ? SecurityContext::InsecureContentMonitor : SecurityContext::InsecureContentUpgrade);
+    if (!value.isEmpty())
+        m_policy->reportValueForEmptyDirective(name, value);
+}
+
 void CSPDirectiveList::parseReflectedXSS(const String& name, const String& value)
 {
     if (m_reflectedXSSDisposition != ReflectedXSSUnset) {
         m_policy->reportDuplicateDirective(name);
         m_reflectedXSSDisposition = ReflectedXSSInvalid;
         return;
     }
 
     if (value.isEmpty()) {
         m_reflectedXSSDisposition = ReflectedXSSInvalid;
@@ skipping 130 matching lines @@
         setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReflectedXSS)) {
         parseReflectedXSS(name, value);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) {
         parseReferrer(name, value);
     } else if (m_policy->experimentalFeaturesEnabled()) {
         if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc))
             setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
         else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedContent))
             enforceStrictMixedContentChecking(name, value);
+        else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureContent))

[Mike West, 2015/02/05 13:39:34]

This probably wasn't clear from the diff, but we only hit this piece if the
"Experimental CSP" flag is set.

[Yoav Weiss, 2015/02/05 13:49:13]

Yeah, missed that :)

+            enableInsecureContentUpgrade(name, value);
         else
             m_policy->reportUnsupportedDirective(name);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace blink