Mixed-content carve-out for local and loopback address spaces

Component: WebCore Mixed Content | 66d43be

Mixed Content blocking stops an HTTPS page from loading insecure HTTP sub-resources, either by upgrading the request to HTTPS or refusing it outright, so a network attacker cannot tamper with content on a secure page. The Local Network Access (LNA) spec introduces a separate permission gate — closer in shape to a camera or microphone prompt — for pages that want to reach devices on the user's local network, a surface with a long history of SSRF and CSRF against routers and IoT devices that trust their LAN. The two systems have to be wired together, because Mixed Content now needs to know a request's target IP address space before deciding whether its own rules apply.

This commit amends the upgrade/block logic to exempt requests targeting local or loopback address spaces, deferring those decisions to LNA's permission system. Because only fetch() sets a target address space explicitly, non-fetch loaders — images, XHR, ordinary sub-resources — now derive one from the URL through a new effectiveTargetAddressSpace() helper.

Significance

Without the carve-out an HTTPS page could never load plain-HTTP content from a local device, so the incoming LNA permission prompt would be unreachable in practice. This is the seam where one security check steps aside for another, and the handoff has to be total: anything that falls between the two is unmediated.

Audit directions

The forward-facing pattern is a security check that exempts a class of requests on the understanding that a second check will cover them. Narrow: effectiveTargetAddressSpace() derives an address space from a URL, so the audit question for every consumer is whether the derived value can differ from where the request actually ends up — and what the resulting decision would be if it did. Wider: the exemption and the LNA permission gate are two halves of one policy, so enumerate the loader paths that reach MixedContentChecker and confirm each one that now takes the exemption actually arrives at the permission gate rather than at neither check; a loader added later that does not participate in LNA would inherit the carve-out for free. Widest: whenever a checker gains a new early return, the reviewer's job is to name the mechanism that covers the exempted set — in code review, an early return added to a security predicate deserves a comment naming the check that takes over.

---