We need a browser test that validates unsafe resources loaded from the network cache do trigger the safe browsing detection.
From vakh@:
"We should check the SB reputation of items in the cache. Resources in the cache cannot be trusted for 2 reasons:
Safe Browsing did not know that a subresource was unsafe when it got cached but it's SB reputation has since been changed to unsafe.
There can be a race condition between putting the resource in the cache and checking its Safe Browsing reputation and the SB reputation check can lose. In such a case, we can end up caching an unsafe resource.
It is actually more important to check SB reputation when reading from the cache, than writing to the cache."
Comment 1 by benhenry@chromium.org
, Aug 3