From: uazo <uazo@users.noreply.github.com>
Date: Mon, 26 Apr 2021 15:04:11 +0000
Subject: Add IsCleartextPermitted flag

---
 chrome/browser/about_flags.cc           | 4 ++++
 chrome/browser/flag_descriptions.cc     | 4 ++++
 chrome/browser/flag_descriptions.h      | 3 +++
 net/base/features.cc                    | 3 +++
 net/base/features.h                     | 2 ++
 net/url_request/url_request_http_job.cc | 4 ++++
 6 files changed, 20 insertions(+)

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -8201,6 +8201,10 @@ const FeatureEntry kFeatureEntries[] = {
      flag_descriptions::kRequestDesktopSiteExceptionsName,
      flag_descriptions::kRequestDesktopSiteExceptionsDescription, kOsAndroid,
      FEATURE_VALUE_TYPE(features::kRequestDesktopSiteExceptions)},
+    {"cleartext-permitted",
+     flag_descriptions::kIsCleartextPermittedName,
+     flag_descriptions::kIsCleartextPermittedDescription, kOsAndroid,
+     FEATURE_VALUE_TYPE(net::features::kIsCleartextPermitted)},
 #endif
 
     {"export-bookmarks-use-saf",
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -1477,6 +1477,10 @@ const char kHttpsOnlyModeDescription[] =
     "Adds a setting under chrome://settings/security to opt-in to HTTPS-First "
     "Mode.";
 
+const char kIsCleartextPermittedName[] = "Allow cleartext traffic";
+const char kIsCleartextPermittedDescription[] =
+    "Allow insecure connections over HTTP";
+
 const char kIgnoreGpuBlocklistName[] = "Override software rendering list";
 const char kIgnoreGpuBlocklistDescription[] =
     "Overrides the built-in software rendering list and enables "
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -834,6 +834,9 @@ extern const char kHideShelfControlsInTabletModeDescription[];
 extern const char kHttpsOnlyModeName[];
 extern const char kHttpsOnlyModeDescription[];
 
+extern const char kIsCleartextPermittedName[];
+extern const char kIsCleartextPermittedDescription[];
+
 extern const char kIgnoreGpuBlocklistName[];
 extern const char kIgnoreGpuBlocklistDescription[];
 
diff --git a/net/base/features.cc b/net/base/features.cc
--- a/net/base/features.cc
+++ b/net/base/features.cc
@@ -115,6 +115,9 @@ const base::Feature kEnableTLS13EarlyData{"EnableTLS13EarlyData",
 const base::Feature kEncryptedClientHello{"EncryptedClientHello",
                                           base::FEATURE_DISABLED_BY_DEFAULT};
 
+const base::Feature kIsCleartextPermitted{"IsCleartextPermitted",
+                                      base::FEATURE_ENABLED_BY_DEFAULT};
+
 const base::Feature kNetworkQualityEstimator{"NetworkQualityEstimator",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 
diff --git a/net/base/features.h b/net/base/features.h
--- a/net/base/features.h
+++ b/net/base/features.h
@@ -37,6 +37,8 @@ NET_EXPORT extern const base::Feature kCapReferrerToOriginOnCrossOrigin;
 // Enables the ParsedCookie domain attribute to be the empty string.
 NET_EXPORT extern const base::Feature kCookieDomainAttributeEmptyString;
 
+NET_EXPORT extern const base::Feature kIsCleartextPermitted;
+
 // Support for altering the parameters used for DNS transaction timeout. See
 // ResolveContext::SecureTransactionTimeout().
 NET_EXPORT extern const base::Feature kDnsTransactionDynamicTimeouts;
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -210,6 +210,10 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
     }
 
 #if BUILDFLAG(IS_ANDROID)
+    if (base::FeatureList::IsEnabled(net::features::kIsCleartextPermitted) == false) {
+      return std::make_unique<URLRequestErrorJob>(request,
+                                                  ERR_CLEARTEXT_NOT_PERMITTED);
+    }
     // Check whether the app allows cleartext traffic to this host, and return
     // ERR_CLEARTEXT_NOT_PERMITTED if not.
     if (request->context()->check_cleartext_permitted() &&
--
2.25.1