CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/Source/core/frame/csp/ContentSecurityPolicy.cpp b/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 1cbc364bc33aa407a0d368bae013ff860a5bf255..3cdca98d5e49f7c30f37326a2d0edb0806d18f63 100644
--- a/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -93,6 +93,9 @@ const char ContentSecurityPolicy::ManifestSrc[] = "manifest-src";
 // https://w3c.github.io/webappsec/specs/mixedcontent/#strict-mode
 const char ContentSecurityPolicy::BlockAllMixedContent[] = "block-all-mixed-content";
 
+// https://w3c.github.io/webappsec/specs/upgrade/
+const char ContentSecurityPolicy::UpgradeInsecureContent[] = "upgrade-insecure-content";
+
 bool ContentSecurityPolicy::isDirectiveName(const String& name)
 {
     return (equalIgnoringCase(name, ConnectSrc)

[Yoav Weiss, 2015/02/05 13:25:36]

Unrelated to current patch, but we're lowercasing `name` here many, many times.
Is there some caching inside String that handles that? If not, we may want to
lower case it once and compare using "==" (Or build such caching into String)

[Mike West, 2015/02/05 13:39:34]

Sounds reasonable. I'll follow up on that.

@@ -114,7 +117,8 @@ bool ContentSecurityPolicy::isDirectiveName(const String& name)
         || equalIgnoringCase(name, ReflectedXSS)
         || equalIgnoringCase(name, Referrer)
         || equalIgnoringCase(name, ManifestSrc)
-        || equalIgnoringCase(name, BlockAllMixedContent));
+        || equalIgnoringCase(name, BlockAllMixedContent)
+        || equalIgnoringCase(name, UpgradeInsecureContent));
 }
 
 static UseCounter::Feature getUseCounterType(ContentSecurityPolicyHeaderType type)
@@ -144,6 +148,7 @@ ContentSecurityPolicy::ContentSecurityPolicy()
     , m_sandboxMask(0)
     , m_enforceStrictMixedContentChecking(false)
     , m_referrerPolicy(ReferrerPolicyDefault)
+    , m_insecureContentPolicy(SecurityContext::InsecureContentIgnore)
 {
 }
 
@@ -171,6 +176,8 @@ void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()
             document->enforceStrictMixedContentChecking();
         if (didSetReferrerPolicy())
             document->setReferrerPolicy(m_referrerPolicy);
+        if (m_insecureContentPolicy > document->insecureContentPolicy())
+            document->setInsecureContentPolicy(m_insecureContentPolicy);
 
         for (const auto& consoleMessage : m_consoleMessages)
             m_executionContext->addConsoleMessage(consoleMessage);
@@ -626,6 +633,12 @@ void ContentSecurityPolicy::enforceStrictMixedContentChecking()
     m_enforceStrictMixedContentChecking = true;
 }
 
+void ContentSecurityPolicy::setInsecureContentPolicy(SecurityContext::InsecureContentPolicy policy)
+{
+    if (policy > m_insecureContentPolicy)
+        m_insecureContentPolicy = policy;
+}
+
 static String stripURLForUseInReport(Document* document, const KURL& url)
 {
     if (!url.isValid())