Live repro: https://fiddlerbook.com/test/csp/

Version 52.0.2729.1

Also repros in Firefox 46.0.1

I have already reported Mozilla security team. They said "this is indeed a bug we should fix." 

#610188 likely shares the same root cause.

Hrm. The code at https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp&l=678 is supposed to handle this case. Of course, I apparently didn't write tests for it, so this probably regressed in some recent refactoring. :/

Thanks for the report!

Mike- I'm torn between whether this should be labeled low-severity or just a regular bug related to severity. I'll err on the side of caution and mark it as low-severity for now; please feel free to remove the view restriction if you want.

Since the impact on HTTPS sites is that the frame isn't loaded (it's blocked as mixed content), I'd suggest that there's little practical risk from a security perspective. There's some more substantial risk from the "Hey, why isn't this doing the thing that I, the developer, asked it to do!", of course.

Bounty reward will not be paid on severity-low.  My question is...Will severity-low bug be eligible for hall of fame? 

Re: #7-- it's true that a same-domain subframe would get blocked as mixed-content, but this bug is broader than that as it also applies to top-level navigations to same-domain sites. Those top-level navigations would not be blocked and take place over a non-secure channel. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/06d6974d6903554b04ce7e4eaf7a007ad0455f1e

commit 06d6974d6903554b04ce7e4eaf7a007ad0455f1e
Author: mkwst <mkwst@chromium.org>
Date: Wed May 11 09:57:02 2016

UPGRADE: Correctly handle navigations.

The behavior of 'upgrade-insecure-requests' has regressed for iframes and
navigations due to some recent changes in those bits of the loader. Of
course, I was an idiot, and didn't write layout tests for those pieces,
but relied on unit tests. The unit tests kept working, because they hard
coded the expected inputs! Hooray! The web, however, broke. Bleh.

This patch adjusts things such that iframes and navigations are correctly
upgraded in the presence of the directive.

As a drive-by, it also disables the mixed content warning that we show for
insecure form actions on secure pages if upgrading is active (as part of
the UIR promise is that we won't break your security indicators).

BUG= 610441 , 610188 

Review-Url: https://codereview.chromium.org/1964303003
Cr-Commit-Position: refs/heads/master@{#392890}

[add] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/LayoutTests/http/tests/security/resources/post-origin-to-parent.html
[add] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/LayoutTests/http/tests/security/upgrade-insecure-requests/form-upgrade.html
[add] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/LayoutTests/http/tests/security/upgrade-insecure-requests/iframe-upgrade.https.html
[modify] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
[modify] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/Source/core/loader/FormSubmission.cpp
[modify] https://crrev.com/06d6974d6903554b04ce7e4eaf7a007ad0455f1e/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

Hopefully fixed. Thanks for the report!

Will this report be listed on Honorable mention? If so, please use "Takashi Suzuki" as reporter's name. This issue has been "restricted" for a while.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot