[Browser] Support for Safe Browsing API

[Adnane Belmadiaf]

The browser needs a way to check pages against malwares/phishing etc..

FF OS does use the Safe Browsing Lookup API
https://developers.google.com/safe-browsing/
https://developers.google.com/safe-browsing/lookup_guide

--- --- --- ---
UX Comment:
Current design spec appears to already account for this. Please notify me if any additional design is required.

[Adnane Belmadiaf (daker)]

try {
    var req = new XMLHttpRequest();

    req.onreadystatechange = function () {
        if (req.readyState == XMLHttpRequest.DONE) {
            console.debug("Debug: " + req.responseText)
        } else {}
    };

    req.open("GET", "https://sb-ssl.google.com/safebrowsing/api/lookup?client=api&apikey=ABQIAAAAXn2CrqC-zz0c0lI_8NfQbBQJyEjSvtjLID-f8-9JQcCAZT-Bkg&appver=1.0&pver=3.0&url=" + requestedUrl);
    req.send();
} catch (e) {
    throw new Error("Unable to parse data.");
}

[Olivier Tilloy (osomon)]

See http://www.chromium.org/developers/design-documents/safebrowsing for detailed documentation on how safe browsing is implemented in chromium.

[Chris Coulson (chrisccoulson)]

This is something I'd planned to implement (I thought there was already a bug for it). We want this in Oxide rather than the browser though, so that it's available to all embedders. This isn't something that's available in WebkitGTK or QtWebkit (it's normally implemented at the application level, although I don't think any browsers using these API's implement safebrowsing support either)

[Olivier Tilloy (osomon)]

Marked invalid for webbrowser-app, as this will be implemented in oxide, per Chris’ comment.

[Olivier Tilloy (osomon)]

FTR, as previously discussed with James over IRC, safe browsing is different from insecure certificates warnings. So this requires additional design work (even though it will probably look very similar). Not sure what the oxide API will look like. Will the embedder be left responsible for displaying some sort of interstitial page, or will that be done by oxide directly?