Enforce HTTPS URLs to show app banners.

chrome/browser/android/banners/app_banner_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/android/banners/app_banner_manager.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 26 matching lines @@
 #include "ui/gfx/screen.h"
 
 using base::android::ConvertJavaStringToUTF8;
 using base::android::ConvertJavaStringToUTF16;
 using base::android::ConvertUTF8ToJavaString;
 using base::android::ConvertUTF16ToJavaString;
 
 namespace {
 const char kBannerTag[] = "google-play-id";
 base::TimeDelta gTimeDeltaForTesting;
+bool gDisableSecureCheckForTesting = false;
 }  // namespace
 
 namespace banners {
 
 // Fetches a bitmap and deletes itself when completed.
 class AppBannerManager::BannerBitmapFetcher
     : public chrome::BitmapFetcher,
       public chrome::BitmapFetcherDelegate {
  public:
   BannerBitmapFetcher(const GURL& image_url,
@@ skipping 68 matching lines @@
   native_app_package_ = std::string();
 }
 
 void AppBannerManager::DidFinishLoad(
     content::RenderFrameHost* render_frame_host,
     const GURL& validated_url) {
   if (render_frame_host->GetParent())
     return;
   validated_url_ = validated_url;
 
+  // A secure scheme is required to show banners, so exit early if we see the
+  // URL is invalid.
+  if (!validated_url_.SchemeIsSecure() && !gDisableSecureCheckForTesting)
+    return;
+
   // See if the page has a manifest. Using Unretained(this) here is safe as the
   // lifetime of this object extends beyond the lifetime of the web_contents(),
   // and when web_contents() is destroyed it will call OnDidGetManifest.
   web_contents()->GetManifest(base::Bind(&AppBannerManager::OnDidGetManifest,
                                          base::Unretained(this)));
 }
 
 void AppBannerManager::OnDidGetManifest(const content::Manifest& manifest) {
   if (web_contents()->IsBeingDestroyed())
     return;
@@ skipping 211 matching lines @@
 
 jboolean IsEnabled(JNIEnv* env, jclass clazz) {
   return base::CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kEnableAppInstallAlerts);
 }
 
 void SetTimeDeltaForTesting(JNIEnv* env, jclass clazz, jint days) {
   gTimeDeltaForTesting = base::TimeDelta::FromDays(days);
 }
 
+void DisableSecureSchemeCheckForTesting(JNIEnv* env, jclass clazz) {
+  gDisableSecureCheckForTesting = true;
+}
+
 // Register native methods
 bool RegisterAppBannerManager(JNIEnv* env) {
   return RegisterNativesImpl(env);
 }
 
 }  // namespace banners