CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1384 matching lines @@
         return false;
 
     // FIXME: We need a way to propagate strict mixed content checking flags to
     // out-of-process frames. For now, we'll always enforce.
     if (!parentFrame->isLocalFrame())
         return true;
 
     return toLocalFrame(parentFrame)->document()->shouldEnforceStrictMixedContentChecking();
 }
 
+SecurityContext::InsecureContentPolicy FrameLoader::insecureContentPolicy() const
+{
+    Frame* parentFrame = m_frame->tree().parent();
+    if (!parentFrame)
+        return SecurityContext::InsecureContentIgnore;
+
+    // FIXME: We need a way to propagate insecure content policy flags to
+    // out-of-process frames. For now, we'll always upgrade.
+    if (!parentFrame->isLocalFrame())
+        return SecurityContext::InsecureContentUpgrade;

[Yoav Weiss, 2015/02/05 13:25:36]

Why always upgrade? Isn't ignoring the safer option if we don't know what to do?

[Mike West, 2015/02/05 13:39:34]

I suppose so. *shrug* I'll change it. :)

+
+    return toLocalFrame(parentFrame)->document()->insecureContentPolicy();
+}
+
 } // namespace blink