Don't grant special privs to any http URL, ever.

chrome/renderer/chrome_content_renderer_client_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include "base/utf_string_conversions.h"
 #include "googleurl/src/gurl.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebString.h"
@@ skipping 118 matching lines @@
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
         GURL("chrome-extension://acadkphlmlegjaadjagenfimbpphcgnh"),
         GURL(), kNaClRestricted, kExtensionRestricted,
         kExtensionFromWebStore, &params));
     EXPECT_TRUE(AllowsDevInterfaces(params));
   }
   // Whitelisted URLs are allowed without --enable-nacl, without 'dev'
   // interfaces.
   {
     WebPluginParams params;
-    EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
+    EXPECT_FALSE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("http://plus.google.com/games"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("https://plus.google.com/games"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("https://plus.google.com/games/209089085730"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
-    EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
+    EXPECT_FALSE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("http://plus.sandbox.google.com/games"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("https://plus.sandbox.google.com/games"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
@@ skipping 19 matching lines @@
     EXPECT_TRUE(ChromeContentRendererClient::IsNaClAllowed(
         GURL(), GURL("https://plus.google.com/games/209089085730"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
     EXPECT_FALSE(AllowsDevInterfaces(params));
   }
   // Non-whitelisted URLs are blocked without --enable-nacl.
   {
     WebPluginParams params;
     EXPECT_FALSE(ChromeContentRendererClient::IsNaClAllowed(
-        GURL(), GURL("http://plus.google.com.evil.com/games"),
+        GURL(), GURL("https://plus.google.com.evil.com/games"),
         kNaClRestricted, kExtensionRestricted, kExtensionNotFromWebStore,
         &params));
   }
 }
 
 }  // namespace chrome