Added console message for mixed content autoupgrade events.

Change-Id: I7f39643ed0a932adf0d4677ff4e676fe0b9cec00
Reviewed-on: https://chromium-review.googlesource.com/c/1352574
Commit-Queue: Carlos IL <carlosil@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611986}

docs/security/autoupgrade-mixed.md

+# Mixed content Autoupgrade
+
+## Description
+We are currently running an experiment upgrading mixed content (insecure content on secure sites) to HTTPS, as part of this, some users will see HTTP subresource URLs rewritten as HTTPS when browsing a site served over HTTPS. This is similar behavior to that if the site included the Upgrade-Insecure-Requests CSP directive.
+
+## Scope
+Currently subresources loaded over HTTP and Websocket URLs are autoupgraded for users who are part of the experiment. Form submissions are not currently part of the experiment.
+
+## Fallback
+A subset of users who are part of the experiment have fallback enabled, that is, if the resources fail to load over HTTPS or the load hangs, they retry the load over HTTP.
+
+## Opt-out
+You can opt out of having mixed content autoupgraded in your site by including an HTTP header with type 'mixed-content' and value 'noupgrade', this will disable autoupgrades for subresources. Since mixed content websockets are automatically blocked, autoupgrades cannot be disabled for those.

third_party/blink/renderer/core/loader/frame_loader.cc

@@ -1701,6 +1701,9 @@ void FrameLoader::UpgradeInsecureRequest(ResourceRequest& resource_request,
             WebMixedContent::ContextTypeFromRequestContext(context, false))) {
       if (origin_context->IsDocument()) {
         Document* document = static_cast<Document*>(origin_context);
+        document->AddConsoleMessage(
+            MixedContentChecker::CreateConsoleMessageAboutFetchAutoupgrade(
+                origin_context->Url(), resource_request.Url()));
         resource_request.SetUkmSourceId(document->UkmSourceID());
       }
       resource_request.SetIsAutomaticUpgrade(true);

third_party/blink/renderer/core/loader/mixed_content_checker.cc

@@ -768,6 +768,40 @@ void MixedContentChecker::MixedContentFound(
   }
 }
 
+// static
+ConsoleMessage* MixedContentChecker::CreateConsoleMessageAboutFetchAutoupgrade(
+    const KURL& main_resource_url,
+    const KURL& mixed_content_url) {
+  String message = String::Format(
+      "Mixed Content: The page at '%s' was loaded over HTTPS, but requested an "
+      "insecure element '%s'. As part of an experiment this request was "
+      "automatically upgraded to HTTPS, For more information see "
+      "https://chromium.googlesource.com/chromium/src/+/master/docs/security/"
+      "autougprade-mixed.md",
+      main_resource_url.ElidedString().Utf8().data(),
+      mixed_content_url.ElidedString().Utf8().data());
+  return ConsoleMessage::Create(kSecurityMessageSource, kWarningMessageLevel,
+                                message);
+}
+
+// static
+ConsoleMessage*
+MixedContentChecker::CreateConsoleMessageAboutWebSocketAutoupgrade(
+    const KURL& main_resource_url,
+    const KURL& mixed_content_url) {
+  String message = String::Format(
+      "Mixed Content: The page at '%s' was loaded over HTTPS, but attempted "
+      "to connect to the insecure WebSocket endpoint '%s'. As part of an "
+      "experiment this request was automatically upgraded to HTTPS, For more "
+      "information see "
+      "https://chromium.googlesource.com/chromium/src/+/master/docs/security/"
+      "autougprade-mixed.md",
+      main_resource_url.ElidedString().Utf8().data(),
+      mixed_content_url.ElidedString().Utf8().data());
+  return ConsoleMessage::Create(kSecurityMessageSource, kWarningMessageLevel,
+                                message);
+}
+
 WebMixedContentContextType MixedContentChecker::ContextTypeForInspector(
     LocalFrame* frame,
     const ResourceRequest& request) {

third_party/blink/renderer/core/loader/mixed_content_checker.h

@@ -123,6 +123,14 @@ class CORE_EXPORT MixedContentChecker final {
                                 bool had_redirect,
                                 std::unique_ptr<SourceLocation>);
 
+  static ConsoleMessage* CreateConsoleMessageAboutFetchAutoupgrade(
+      const KURL& main_resource_url,
+      const KURL& mixed_content_url);
+
+  static ConsoleMessage* CreateConsoleMessageAboutWebSocketAutoupgrade(
+      const KURL& main_resource_url,
+      const KURL& mixed_content_url);
+
  private:
   FRIEND_TEST_ALL_PREFIXES(MixedContentCheckerTest, HandleCertificateError);
 

third_party/blink/renderer/modules/websockets/dom_websocket.cc

@@ -318,6 +318,9 @@ void DOMWebSocket::Connect(const String& url,
     if (!upgrade_insecure_requests_set) {
       was_autoupgraded_to_wss_ = true;
       LogMixedAutoupgradeStatus(MixedContentAutoupgradeStatus::kStarted);
+      GetExecutionContext()->AddConsoleMessage(
+          MixedContentChecker::CreateConsoleMessageAboutWebSocketAutoupgrade(
+              GetExecutionContext()->Url(), url_));
     }
     UseCounter::Count(GetExecutionContext(),
                       WebFeature::kUpgradeInsecureRequestsUpgradedRequest);

third_party/blink/web_tests/http/tests/mixed-autoupgrade/optionally/image-upgrade-console-message.https-expected.txt

+CONSOLE WARNING: line 2: Mixed Content: The page at 'https://127.0.0.1:8443/mixed-autoupgrade/optionally/image-upgrade-console-message.https.html' was loaded over HTTPS, but requested an insecure element 'http://web-platform.test:8443/mixed-autoupgrade/resources/pass.png'. As part of an experiment this request was automatically upgraded to HTTPS, For more information see https://chromium.googlesource.com/chromium/src/+/master/docs/security/autougprade-mixed.md
+CONSOLE WARNING: Mixed Content: The page at 'https://127.0.0.1:8443/mixed-autoupgrade/optionally/image-upgrade-console-message.https.html' was loaded over HTTPS, but requested an insecure element 'http://web-platform.test:8443/mixed-autoupgrade/resources/pass.png'. As part of an experiment this request was automatically upgraded to HTTPS, For more information see https://chromium.googlesource.com/chromium/src/+/master/docs/security/autougprade-mixed.md

third_party/blink/web_tests/http/tests/mixed-autoupgrade/optionally/image-upgrade-console-message.https.html

+<!DOCTYPE html>
+<html>
+<head>
+<title>Autoupgrade mixed content: Console Message.</title>
+</head>
+<body>
+  <img src="http://web-platform.test:8443/mixed-autoupgrade/resources/pass.png">
+</body>
+</html>