CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/fetch/ResourceFetcher.cpp

Index: Source/core/fetch/ResourceFetcher.cpp
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index d67eb023c759718c5305aaf0c69adfaee7704ab3..c7be6eae263826fc481de0a053020efa16f1aa98 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -66,6 +66,7 @@
 #include "platform/Logging.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/TraceEvent.h"
+#include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
@@ -715,6 +716,8 @@ ResourcePtr<Resource> ResourceFetcher::requestResource(Resource::Type type, Fetc
 
     TRACE_EVENT0("blink", "ResourceFetcher::requestResource");
 
+    maybeUpgradeInsecureRequestURL(request);
+
     KURL url = request.resourceRequest().url();
 
     WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource '%s', charset '%s', priority=%d, forPreload=%u, type=%s", url.elidedString().latin1().data(), request.charset().latin1().data(), request.priority(), request.forPreload(), ResourceTypeName(type));
@@ -895,6 +898,20 @@ void ResourceFetcher::addAdditionalRequestHeaders(ResourceRequest& request, Reso
     context().addAdditionalRequestHeaders(document(), request, (type == Resource::MainResource) ? FetchMainResource : FetchSubresource);
 }
 
+void ResourceFetcher::maybeUpgradeInsecureRequestURL(FetchRequest& request)

[Yoav Weiss, 2015/02/06 09:58:36]

"monitor" does nothing for now, right?

Maybe add a FIXME to that effect?

+{
+    if (!m_document)
+        return;
+
+    KURL url = request.resourceRequest().url();
+    if (m_document->insecureContentPolicy() == SecurityContext::InsecureContentUpgrade && url.protocol() == "http") {
+        url.setProtocol("https");
+        if (url.port() == 80)
+            url.setPort(443);
+        request.mutableResourceRequest().setURL(url);
+    }
+}
+
 ResourcePtr<Resource> ResourceFetcher::createResourceForRevalidation(const FetchRequest& request, Resource* resource)
 {
     ASSERT(resource);