CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/fetch/ResourceFetcher.cpp

Index: Source/core/fetch/ResourceFetcher.cpp
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index d67eb023c759718c5305aaf0c69adfaee7704ab3..344404e062f5f51cb7aebed4c25120115665e5b5 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -66,6 +66,7 @@
 #include "platform/Logging.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/TraceEvent.h"
+#include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
@@ -717,6 +718,16 @@ ResourcePtr<Resource> ResourceFetcher::requestResource(Resource::Type type, Fetc
 
     KURL url = request.resourceRequest().url();
 
+    if (m_document && m_document->insecureContentPolicy() == SecurityContext::InsecureContentUpgrade && url.protocol() == "http") {
+        url.setProtocol("https");
+        // FIXME: HACKY HACKY HACKY HACKY.
+        if (url.port() == 8000 || url.port() == 8080)
+            url.setPort(8443);

[Mike West, 2015/02/05 12:35:01]

:(

I think we need some sort of platform API that allows the embedder to give us
the default port (which we can override in layouttests), rather than relying on
KnownPorts.h in Blink.

WDYT of that approach?

+        else if (url.port() == 80)
+            url.setPort(443);

[Yoav Weiss, 2015/02/05 13:25:36]

What happens if the port is neither one of those? Do we send https traffic on
the same original port and hope for the best?

[Mike West, 2015/02/05 13:39:34]

Yup. Same as HSTS. See the comment I just added to the spec in step 8 of
https://w3c.github.io/webappsec/specs/upgrade/#upgrade-request.

+        request.mutableResourceRequest().setURL(url);
+    }
+
     WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource '%s', charset '%s', priority=%d, forPreload=%u, type=%s", url.elidedString().latin1().data(), request.charset().latin1().data(), request.priority(), request.forPreload(), ResourceTypeName(type));
 
     // If only the fragment identifiers differ, it is the same resource.