Don't grant special privs to any http URL, ever.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
@@ skipping 655 matching lines @@
 bool ChromeContentRendererClient::IsNaClAllowed(
     const GURL& manifest_url,
     const GURL& top_url,
     bool is_nacl_unrestricted,
     bool is_extension_unrestricted,
     bool is_extension_from_webstore,
     WebPluginParams* params) {
   // Temporarily allow these URLs to run NaCl apps. We should remove this
   // code when PNaCl ships.
   bool is_whitelisted_url =
-      ((top_url.SchemeIs("http") || top_url.SchemeIs("https")) &&
+      top_url.SchemeIs("https") &&
       (top_url.host() == "plus.google.com" ||
           top_url.host() == "plus.sandbox.google.com") &&
-      top_url.path().find("/games") == 0);
+      top_url.path().find("/games") == 0;
 
   // Allow Chrome Web Store extensions, built-in extensions, extensions
   // under development, invocations from whitelisted URLs, and all invocations
   // if --enable-nacl is set.
   bool is_nacl_allowed = is_extension_from_webstore ||
                          is_whitelisted_url ||
                          is_extension_unrestricted ||
                          is_nacl_unrestricted;
   if (is_nacl_allowed) {
     bool app_can_use_dev_interfaces =
@@ skipping 365 matching lines @@
 }
 
 void ChromeContentRendererClient::RegisterPPAPIInterfaceFactories(
     webkit::ppapi::PpapiInterfaceFactoryManager* factory_manager) {
 #if defined(ENABLE_PLUGINS)
   factory_manager->RegisterFactory(ChromePPAPIInterfaceFactory);
 #endif
 }
 
 }  // namespace chrome