We're currently not replicating this state. Let's start.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/78faa7546aa65192af48bc2703791b06a7612eba commit 78faa7546aa65192af48bc2703791b06a7612eba Author: mkwst <mkwst@chromium.org> Date: Wed Jun 08 07:07:23 2016 Introduce WebInsecureRequestPolicy. This is the first step towards moving some of 'Upgrade-Insecure-Requests' enforcement up to the browser process. It introduces WebInsecureRequestPolicy which aims to represent both 'Upgrade-Insecure-Requests' and 'Block-All-Mixed-Content' as a single bitfield, as they're really two sides of the same coin. This patch uses the new type inside of //core/frame/csp. The next patch will extend usage to 'SecurityContext' (which has a number of dependencies including 'DocumentInit', 'FrameLoader' and etc, which makes it appealing to split out). That will be followed by a patch which replicates the new data to remote frames. With that infrastructure in place, upgrading requests during redirects should be (somewhat) straightforward. [Step 1]: This patch. [Step 2]: https://codereview.chromium.org/2040133003 [Step 3]: https://codereview.chromium.org/2046733003 BUG=617947 R=yoav@yoav.ws Review-Url: https://codereview.chromium.org/2046523005 Cr-Commit-Position: refs/heads/master@{#398497} [modify] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp [modify] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp [modify] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h [modify] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp [modify] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/public/blink_headers.gypi [add] https://crrev.com/78faa7546aa65192af48bc2703791b06a7612eba/third_party/WebKit/public/platform/WebInsecureRequestPolicy.h
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/12f4d38a6a405aa5c07b235048cab2d478b0b92c commit 12f4d38a6a405aa5c07b235048cab2d478b0b92c Author: mkwst <mkwst@chromium.org> Date: Thu Jun 09 14:58:40 2016 Replace SecurityContext::InsecureRequestsPolicy with WebInsecureRequestPolicy. Introduced in https://codereview.chromium.org/2046523005, WebInsecureRequestPolicy aims to represent the complete policy set by a context for insecure requests. This patch expands its usage from //core/frame/csp to encompass all of blink, replacing 'SecurityContext::InsecureRequestsPolicy' and the strict mixed content checking boolean in various bits of our loading infrastructure. The next step will be to replicate this bitfield to remote frames instead of replicating the strict mixed content checking boolean. [Step 1]: https://codereview.chromium.org/2046523005 [Step 2]: This patch. [Step 3]: https://codereview.chromium.org/2046733003 BUG=617947 R=yoav@yoav.ws Review-Url: https://codereview.chromium.org/2040133003 Cr-Commit-Position: refs/heads/master@{#398879} [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/Document.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/Document.h [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/DocumentInit.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/DocumentInit.h [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/SecurityContext.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/dom/SecurityContext.h [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/html/HTMLFormElement.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/FormSubmission.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/FrameFetchContextTest.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/FrameLoader.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/FrameLoader.h [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/core/loader/MixedContentChecker.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/modules/websockets/DOMWebSocketTest.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/web/WebFrame.cpp [modify] https://crrev.com/12f4d38a6a405aa5c07b235048cab2d478b0b92c/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f672e7ef4c5e3227c2874447ad992dc06f48337d commit f672e7ef4c5e3227c2874447ad992dc06f48337d Author: mkwst <mkwst@chromium.org> Date: Thu Jun 09 20:51:07 2016 Replicate WebInsecureRequestPolicy instead of a bool for strict mixed content checks. This patch is huge, but fairly mechanically replaces the bool sitting on the replicated frame state with WebInsecureRequestPolicy (which is currently a bitfield, but will eventually be an enum once https://crbug.com/617584 is addressed). This bitfield holds both 'upgrade-insecure-requests' and 'block-all-mixed-content' state, which means we can take care of replicating both in one shot. [Step 1]: https://codereview.chromium.org/2046523005 [Step 2]: https://codereview.chromium.org/2040133003 [Step 3]: This patch. BUG=617947 CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation Review-Url: https://codereview.chromium.org/2046733003 Cr-Commit-Position: refs/heads/master@{#399008} [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/DEPS [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/frame_tree_node.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/frame_tree_node.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/navigator_impl.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/render_frame_host_impl.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/render_frame_host_impl.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/render_frame_host_manager.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/render_frame_host_manager.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/frame_host/render_frame_host_manager_unittest.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/browser/site_per_process_browsertest.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/common/DEPS [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/common/frame_messages.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/common/frame_replication_state.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/common/frame_replication_state.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/renderer/render_frame_impl.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/renderer/render_frame_impl.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/renderer/render_frame_proxy.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/renderer/render_frame_proxy.h [add] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/test/data/mixed-content/basic-passive-in-iframe-with-upgrade.html [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/test/test_render_frame_host.cc [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/content/test/test_render_frame_host.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/core/dom/Document.cpp [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/core/loader/FrameLoaderClient.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/web/FrameLoaderClientImpl.cpp [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/web/FrameLoaderClientImpl.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/web/WebFrame.cpp [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/web/WebRemoteFrameImpl.cpp [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/Source/web/WebRemoteFrameImpl.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/public/web/WebFrame.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/public/web/WebFrameClient.h [modify] https://crrev.com/f672e7ef4c5e3227c2874447ad992dc06f48337d/third_party/WebKit/public/web/WebRemoteFrame.h
Mike, can this be closed as fixed, or is there any more work to do here?
Adding estark@, in case she has some insight if more work is needed.
Comment 1 by mkwst@chromium.org
, Jun 7 2016