GitLab

Before this CL, there would be an inconsistency between origins
calculated by Blink vs //url for standard, no-access scheme URLs
which meant that (browser-side, //url-based) NavigationRequest::
GetOriginForURLLoaderFactory would return a non-opaque origin,
while (renderer-side, SecurityOrigin-based) Blink would commit
an opaque origin.

The CL ensures that IsValidInput in //url's scheme_host_port.cc
considers no-access first, before any consideration of whether the
scheme is standard - this makes it more consistent with how
ShouldTreatAsOpaqueOrigin in Blink's security_origin.cc works.

After this CL (i.e. after returning an opaque origin for
no-access schemes), we still want to treat no-access-scheme URLs
as potentially trustworthy - this requires small additional
tweaks in IsUrlPotentiallyTrustworthy.

Bug: 888079, 1021779, 1020201
Change-Id: I5e957700011186c312366c818bf143a027f025ce
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2602402Reviewed-by: Maksim Orlovich <morlovich@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Aaron Colwell <acolwell@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#842306}