commit af98eac824bcc23ff253765682f13a60d8340c0c
author Frédéric Wang <fwang@igalia.com> Fri Jan 15 11:35:08 2021
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Jan 15 11:35:08 2021
tree c0860d0d06ba777b80bdfd54661052d52d5985d6
parent c39cb22dc45e023ab428c535812f889c0edecfd4

Rewrite SecurityOrigin::IsSecure() using GURL and url::Origin

SecurityOrigin::IsSecure() is very similar to the concept of
"potentially trustworthy URL" defined in [1] and implemented by
network::IsUrlPotentiallyTrustworthy(), but it has historically been
hard to compare them. After previous refactoring they are quite close.

This CL is yet another iteration. SecurityOrigin::IsSecure() is
rewritten to use a similar implementation based on GURL and url::Origin.
Spec comments are also added to make the difference more obvious.

IsSecure() currently returns true if the URL scheme is in the secure
list [2] or possibly one wrapped in a blob: or filesystem:. The
constructor of url::Origin automatically unwraps this kind of URLs
but is also more restrictive about accepted schemes [3]. In particular,
about: and data: URLs or URLs with schemes registered as "secure"
but not "standard" will now generate invalid origins.

Special cases from network::IsUrlPotentiallyTrustworthy() are added to
preserve behavior with about: and data: schemes, although some weird
edge cases like "about:about" or "blob:about" are no longer treated as
secure. Behavior for all standard secure schemes (including https, wss,
quic-transport) are preserved. All these changes makes IsSecure()
closer to  the spec definition of "potentially trustworthy URL".

The rest of the IsSecure() handles opaque and allowedlist origins, which
is again just a subset of the work done by
network::IsUrlPotentiallyTrustworthy() and can be rewritten accordingly.

[1] https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy
[2] https://source.chromium.org/chromium/chromium/src/+/master:url/url_util.cc;l=63;drc=65a062c4528790ff3651920ba9a3934df184e1bc
[3] https://source.chromium.org/chromium/chromium/src/+/master:url/origin.cc;l=47;drc=721926d0cf09b42968ec8481792fcd6fa4edab7b

Bug: 1153336
Change-Id: I8f4a42f89a9ae13016a20a1e242c1efd48874162
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2617709
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Frédéric Wang <fwang@igalia.com>
Cr-Commit-Position: refs/heads/master@{#844034}