From db1284730fcacbcb7413e08ed7c139b28670340f Mon Sep 17 00:00:00 2001
From: J0WI <J0WI@users.noreply.github.com>
Date: Wed, 3 Jan 2018 15:30:46 +0100
Subject: [PATCH 1/2] Re-enable MIT.xml (#12002)

* Re-run Travis

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT-mismatches.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT-mismatches.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml

* Update MIT.xml
---
 src/chrome/content/rules/MIT-mismatches.xml |   5 -
 src/chrome/content/rules/MIT.xml            | 319 +++-----------------
 2 files changed, 49 insertions(+), 275 deletions(-)

diff --git a/src/chrome/content/rules/MIT-mismatches.xml b/src/chrome/content/rules/MIT-mismatches.xml
index 9e0bc41deb63..7d606e0ed1c6 100644
--- a/src/chrome/content/rules/MIT-mismatches.xml
+++ b/src/chrome/content/rules/MIT-mismatches.xml
@@ -7,21 +7,16 @@
 	<!--	Direct rewrites:
 				-->
 	<target host="www.advancedligo.mit.edu" />
-	<target host="calendar.mit.edu" />
 	<target host="counter.mit.edu" />
 	<target host="cluedumps.mit.edu" />
 	<target host="diversity.mit.edu" />
-	<target host="executive.mit.edu" />
 	<target host="hacks.mit.edu" />
 	<target host="iceo.mit.edu" />
-	<target host="iceoblog.mit.edu" />
-	<target host="libguides.mit.edu" />
 	<target host="tmg-trackr.media.mit.edu" />
 	<target host="mlkscholars.mit.edu" />
 	<target host="relate.mit.edu" />
 	<!--	Self-signed	-->
 	<target host="people.mit.edu" />
-	<target host="webmail.mit.edu" />
 	<target host="zscore.mit.edu" />
 
 	<!--	Complications:
diff --git a/src/chrome/content/rules/MIT.xml b/src/chrome/content/rules/MIT.xml
index 10ff6b2ffa94..0088a211bba1 100644
--- a/src/chrome/content/rules/MIT.xml
+++ b/src/chrome/content/rules/MIT.xml
@@ -1,39 +1,26 @@
 <!--
-
 	Massachusetts Institute of Technology
 
 	For rules causing false/broken MCB, see MIT.edu-falsemixed.xml.
 	For problematic rules, see MIT-mismatches.xml.
 
-
 	Other MIT rulesets:
+		+ MIT_Press_Journals.org.xml
+		+ TechnologyReview.xml
+		+ technologyreview.in.xml
+		+ Touchstone_Network.xml
 
-		- MIT_Press_Journals.org.xml
-		- TechnologyReview.xml
-		- technologyreview.in.xml
-		- Touchstone_Network.xml
-
-
-	CDN buckets:
-
-		- d3f3qxt87iw6id.cloudfront.net	← cdn.executive
-		- d1baxxa0joomi3.cloudfront.net
-		- duqmab81lwd47.cloudfront.net
-		- ocw.mit.edu.edgesuite.net
-
-
-	Nonfunctional mit.edu hosts in *mit.edu:
-
+	Nonfunctional hosts:
 		- alloy ¹
 		- appinventor ³
 		- ai2.appinventor ⁵
 		- arts ²
 		- artscal ³
+		- calendars (redirects to HTTP)
 		- cesf ²
 		- classics ⁴
 		- cmsw ⁷
 		- connect ³
-
 		- bigdata.csail ⁵
 		- inquir.csail ⁵
 		- nms.csail ²
@@ -41,7 +28,6 @@
 		- research.csail ⁵
 		- tig.csail ⁵
 		- wireless.csail ⁵
-
 		- development ⁵
 		- eaps4 ³
 		- economics ²
@@ -52,14 +38,12 @@
 		- img ⁸
 		- ki ⁵
 		- lsc ⁵
-
 		- atlas.media ³
 		- macroconnections.media	(Shows blank tree)
 		- pantheon.media ²
 		- pulse.media ³
 		- tangible.media ²
 		- web.media
-
 		- mitworld ²
 		- mvl ⁹
 		- oastories ²
@@ -93,9 +77,7 @@
 	ᵉ "client certificate was invalid or not provided"
 	ᶠ Shows student
 
-
 	Problematic hosts in *mit.edu:
-
 		- ^ *
 		- advancedligo ᶜ ᵐ
 		- www.advancedligo ᶜ
@@ -119,11 +101,14 @@
 		- itinfo ⁶
 		- libguides	(LibGuides.com/mismatched)
 		- media		(Cert only matches *.media)
+		- mitei-members ᵐ
 		- mitsloan ᶜ
+		- oeit-tsa ¹
 		- tmg-trackr.media ² ᵐ **
 		- pdos.csail
 		- mlkscholars ⁴
 		- president	(Mixed iframe)
+		- reap ᶜ
 		- resources	(Mixed iframe)
 		- sdm-admissions ᶜ
 		- shass		(Configured for SSL3 only)
@@ -147,183 +132,48 @@
 	⁸ Mismatched, CN: calendar.mit.edu
 	ᶜ Server sends no certificate chain, see https://whatsmychaincert.com
 	ᵐ Mismatched
-
-
-	Partially covered hosts in *mit.edu:
-
-		- calendars *
-
-	* $ redirects to http
-
-
-	Fully covered hosts in *mit.edu:
-
-		- blossoms
-		- ca
-		- chemefacsrch
-
-		- (www.)?csail	(^ → www)
-		- calendar.csail
-		- cap.csail
-		- projects.csail
-
-		- dc
-		- debathena
-		- athena.dialup
-		- (www.)?eecs
-		- eecs-search.eecs
-		- engineering
-		- entrepreneurship
-		- esd
-		- cdn.executive	(→ d3f3qxt87iw6id.cloudfront.net)
-		- cms.executive
-		- future
-		- giving
-		- gsc
-		- ideabank	(→ future)
-		- idm
-		- idp
-		- lgo
-		- lgosdm
-		- innovation
-		- lids
-		- linc
-		- llwebprod2.ll
-		- www.ll
-		- immersion.media
-		- mit150
-		- mit-amps
-		- mosh
-		- mysloan
-		- odge
-		- oeit-tsa
-		- openafs
-		- orgchart
-		- pgp
-		- picker
-		- school-of-engineering-faculty-search
-		- sdm
-		- sdm-admissions
-		- sipb
-		- slice
-		- shop.sloanreview
-		- subscribe.sloanreview
-		- stellar
-		- stuff
-		- teachingexcellence
-		- techtv
-		- tll
-
-
-	These altnames don't exist:
-
-		- md.media.mit.edu
-		- rlecal.mit.edu
-
-
-	linerva: Dropped over http & https
-
-
-	Insecure cookies are set for these domains and hosts:
-
-		- .csail.mit.edu
-		- lids.mit.edu
-		- .mit150.mit.edu
-		- .mitei.mit.edu
-		- techtv.mit.edu
-		- webmail.mit.edu
-
-
-	Mixed content:
-
-		- iframes, on:
-
-			- libguides from libraries.mit.edu *
-			- president from techtv.mit.edu *
-			- resources from www.google.com *
-
-		- css, on:
-
-			- hacks from $self
-			- tll from fast.fonts.com *
-			- libraries, mitstory from fonts.googleapis.com *
-			- reap from netdna.bootstrapcdn.com *
-			- scripts from web ²
-
-		- Images, on:
-
-			- civic from cmsw.mit.edu
-			- civic from hacks.mit.edu
-			- civic from tech.mit.edu
-			- hacks from $self
-			- idm from $self *
-			- lgosdm from sdm *
-			- llwebprod2.ll, www.ll from www.ll *
-			- mit-amps from $self *
-			- mitsloan from $self *
-			- dc, picker, whereis from web ²
-			- dome from libraries.mit.edu *
-			- mitei-members from mitei.mit.edu *
-			- relate from $self ³
-			- slice from $self *
-			- teachingexcellence from $self *
-			- teachingexcellence from oeit-tsa *
-			- techtv from duqmab81lwd47.cloudfront.net *
-
-		- favicon on www.media from $self *
-
-		- Ads/bugs, on:
-
-			- executive from pixel.fetchback.com *
-			- hacks from stuff.mit.edu
-			- mit-amps from counter ³
-			- scripts from www.kaltura.com *
-
-	* Secured by us
-	² Unsecurable
-	³ Rule disabled by default <= expired & self-signed
-
 -->
-<ruleset name="MIT.edu (partial)" default_off='failed ruleset test'>
 
-	<!--	Direct rewrites:
-				-->
+<ruleset name="MIT.edu (partial)">
+	<target host="mit.edu" />
+	<target host="www.mit.edu" />
 	<target host="3down.mit.edu" />
-	<!--target host="www.advancedligo.mit.edu" /-->
 	<target host="alum.mit.edu" />
 	<target host="alumsso.mit.edu" />
 	<target host="athena10.mit.edu" />
 	<target host="blossoms.mit.edu" />
 	<target host="ca.mit.edu" />
-	<target host="calendars.mit.edu" />
+	<target host="calendar.mit.edu" />
 	<target host="chemefacsrch.mit.edu" />
 	<target host="civic.mit.edu" />
 	<target host="connect.mit.edu" />
-
+	<target host="csail.mit.edu" />
+	<target host="people.csail.mit.edu" />
+	<target host="eecscal.mit.edu" />
+	<target host="energy.mit.edu" />
+	<target host="executive.mit.edu" />
+	<target host="cdn.executive.mit.edu" />
 	<target host="calendar.csail.mit.edu" />
 	<target host="cap.csail.mit.edu" />
-	<!--target host="css.csail.mit.edu" /-->
 	<target host="groups.csail.mit.edu" />
 	<target host="pdos.csail.mit.edu" />
 	<target host="projects.csail.mit.edu" />
 	<target host="www.csail.mit.edu" />
-
 	<target host="dc.mit.edu" />
 	<target host="debathena.mit.edu" />
 	<target host="athena.dialup.mit.edu" />
 	<target host="dome.mit.edu" />
 	<target host="dspace.mit.edu" />
-
 	<target host="eecs.mit.edu" />
 	<target host="www.eecs.mit.edu" />
-
 	<target host="engineering.mit.edu" />
 	<target host="esd.mit.edu" />
 	<target host="cms.executive.mit.edu" />
-	<target host="oeit-tsa.mit.edu" />
 	<target host="future.mit.edu" />
 	<target host="giving.mit.edu" />
 	<target host="gsc.mit.edu" />
+	<target host="iceoblog.mit.edu" />
+	<target host="ideabank.mit.edu" />
 	<target host="idm.mit.edu" />
 	<target host="idp.mit.edu" />
 	<target host="innovation.mit.edu" />
@@ -331,23 +181,22 @@
 	<target host="kb.mit.edu" />
 	<target host="lgo.mit.edu" />
 	<target host="lgosdm.mit.edu" />
+	<target host="libguides.mit.edu" />
 	<target host="libraries.mit.edu" />
 	<target host="library.mit.edu" />
 	<target host="lids.mit.edu" />
 	<target host="linc.mit.edu" />
 	<target host="listart.mit.edu" />
-
 	<target host="llwebprod2.ll.mit.edu" />
 	<target host="www.ll.mit.edu" />
-
 	<target host="immersion.media.mit.edu" />
 	<target host="www.media.mit.edu" />
-
+	<target host="media.mit.edu" />
 	<target host="mit-amps.mit.edu" />
 	<target host="mit150.mit.edu" />
 	<target host="mitei.mit.edu" />
-	<target host="mitei-members.mit.edu" />
 	<target host="mitpress.mit.edu" />
+	<target host="www.mitpress.mit.edu" />
 	<target host="mitstory.mit.edu" />
 	<target host="mosh.mit.edu" />
 	<target host="mysloan.mit.edu" />
@@ -361,134 +210,64 @@
 	<target host="orgchart.mit.edu" />
 	<target host="pgp.mit.edu" />
 	<target host="picker.mit.edu" />
-	<!--target host="resources.mit.edu" /-->
 	<target host="school-of-engineering-faculty-search.mit.edu" />
-
 	<target host="scratch.mit.edu" />
 	<target host="api.scratch.mit.edu" />
 	<target host="www.scratch.mit.edu" />
-
 	<target host="scripts.mit.edu" />
 	<target host="www.scripts.mit.edu" />
 	<target host="zyan.scripts.mit.edu" />
-
 	<target host="sdm.mit.edu" />
 	<target host="sipb.mit.edu" />
 	<target host="slice.mit.edu" />
-
 	<target host="shop.sloanreview.mit.edu" />
 	<target host="subscribe.sloanreview.mit.edu" />
-
 	<target host="stellar.mit.edu" />
 	<target host="stuff.mit.edu" />
 	<target host="teachingexcellence.mit.edu" />
 	<target host="techtv.mit.edu" />
 	<target host="tll.mit.edu" />
 	<target host="wayf.mit.edu" />
-	<!--target host="webmail.mit.edu" /-->
+	<target host="web.mit.edu" />
+	<target host="webmail.mit.edu" />
 	<target host="whereis.mit.edu" />
 	<target host="wikis.mit.edu" />
 
-	<!--	Complications:
-				-->
-	<!--target host="advancedligo.mit.edu" /-->
-	<target host="csail.mit.edu" />
-	<target host="people.csail.mit.edu" />
-	<target host="eecscal.mit.edu" />
-	<target host="cdn.executive.mit.edu" />
-	<target host="ideabank.mit.edu" />
-	<target host="media.mit.edu" />
-	<target host="www.mitpress.mit.edu" />
-
-		<!--	Redirects to http:
-						-->
-		<exclusion pattern="^http://calendars\.mit\.edu/+(?:$|\?)" />
-		<!--
-			Exceptions:
-					-->
-		<!--exclusion pattern="^http://calendars\.mit\.edu/+(?!Ewf/|Pages/SignUp/Page\.aspx)" /-->
-
-			<!--	+ve:
-
-				(test quota: 4)
-						-->
-			<test url="http://calendars.mit.edu/?" />
-			<test url="http://calendars.mit.edu//" />
-			<test url="http://calendars.mit.edu//?" />
-			<test url="http://calendars.mit.edu///" />
-
-			<!--	-ve:
-					-->
-			<test url="http://calendars.mit.edu/Ewf/VersionedStaticFiles/Backgrounds-v2/Darker.svg" />
-			<test url="http://calendars.mit.edu/Pages/SignUp/Page.aspx" />
-
-		<!--	404:
-				-->
-		<!--test url="http://tmg-trackr.media.mit.edu/publishedmedia/Papers/604-HydroMorph%20Shape%20Changing%20Water/Published/PDF" /-->
-
-		<!--	Mixed images:
-					-->
-		<!--test url="http://civic.mit.edu/blog/erhardt/forbidden-research-liveblog-hacking-culture-at-mit" /-->
-
-
-	<!--	Not secured by server:
-					-->
-	<!--securecookie host="^lids\.mit\.edu$" name="^[0-9a-f]{32}$" /-->
-	<!--securecookie host="^(\.csail|\.mit150|\.mitei)\.mist\.edu$" name="^SESS\w{32}$" /-->
-	<!--securecookie host="^techtv\.mit\.edu$" name="^_TechTV_session$" /-->
-	<!--securecookie host="^webmail\.mit\.edu$" name="^BIGipServerwebmail$" /-->
-
-	<securecookie host="^(?!calendars\.mit\.edu$)\w" name=".+" />
+	<securecookie host="^(?!calendars\.mit\.edu$)\w" name="." />
 	<securecookie host="^\." name="^__utm" />
 
+	<rule from="^http://csail\.mit\.edu/" to="https://www.csail.mit.edu/" />
 
-	<!--rule from="^http://advancedligo\.mit\.edu/"
-		to="https://www.advancedligo.mit.edu/" /-->
-
-	<rule from="^http://csail\.mit\.edu/"
-		to="https://www.csail.mit.edu/" />
-
-	<!--	Redirect keeps args but not forward slash:
-							-->
-	<rule from="^http://people\.csail\.mit\.edu/+(?:\?.*)?$"
-		to="https://www.csail.mit.edu/peoplesearch" />
+	<!-- Redirect keeps args but not forward slash: -->
+	<rule from="^http://people\.csail\.mit\.edu/+(?:\?.*)?$" to="https://www.csail.mit.edu/peoplesearch" />
 
-		<!--	(test quota: 5)
-					-->
-		<test url="http://people.csail.mit.edu/?stupid" />
-		<test url="http://people.csail.mit.edu/?test" />
-		<test url="http://people.csail.mit.edu/?requirement" />
-		<test url="http://people.csail.mit.edu/?for" />
-		<test url="http://people.csail.mit.edu//?stupid" />
-		<test url="http://people.csail.mit.edu//?people" />
-		<test url="http://people.csail.mit.edu//?grudgingly" />
-		<test url="http://people.csail.mit.edu//?filled" />
+	<test url="http://people.csail.mit.edu/?a" />
+	<test url="http://people.csail.mit.edu/?b" />
+	<test url="http://people.csail.mit.edu/?c" />
+	<test url="http://people.csail.mit.edu/?d" />
+	<test url="http://people.csail.mit.edu//?a" />
+	<test url="http://people.csail.mit.edu//?b" />
+	<test url="http://people.csail.mit.edu//?c" />
+	<test url="http://people.csail.mit.edu//?d" />
 
-	<!--	Redirect drops path and args:
-						-->
-	<rule from="^http://eecscal\.mit\.edu/.*"
-		to="https://calendars.mit.edu/eecs" />
+	<!-- Redirect drops path and args: -->
+	<rule from="^http://eecscal\.mit\.edu/.*" to="https://calendars.mit.edu/eecs" />
 
-		<test url="http://eecscal.mit.edu/home.php" />
+	<test url="http://eecscal.mit.edu/home.php" />
 
-	<rule from="^http://cdn\.executive\.mit\.edu/"
-		to="https://d3f3qxt87iw6id.cloudfront.net/" />
+	<rule from="^http://cdn\.executive\.mit\.edu/" to="https://d3f3qxt87iw6id.cloudfront.net/" />
 
-	<rule from="^http://ideabank\.mit\.edu/"
-		to="https://future.mit.edu/" />
+	<rule from="^http://ideabank\.mit\.edu/" to="https://future.mit.edu/" />
 
-	<rule from="^http://www\.mitpress\.mit\.edu/"
-		to="https://mitpress.mit.edu/" />
+	<rule from="^http://www\.mitpress\.mit\.edu/" to="https://mitpress.mit.edu/" />
 
-	<rule from="^http://media\.mit\.edu/"
-		to="https://www.media.mit.edu/" />
+	<rule from="^http://media\.mit\.edu/" to="https://www.media.mit.edu/" />
 
-	<rule from="^http://scripts\.mit\.edu:444/"
-		to="https://scripts.mit.edu:444/" />
+	<rule from="^http://scripts\.mit\.edu:444/" to="https://scripts.mit.edu:444/" />
 
-		<test url="http://scripts.mit.edu:444/" />
+	<test url="http://scripts.mit.edu:444/" />
 
-	<rule from="^http:"
-		to="https:" />
+	<rule from="^http://(www\.)?mit\.edu/" to="https://web.mit.edu/" />
 
+	<rule from="^http:" to="https:" />
 </ruleset>

From 6ab78e994a94b928b883328612217a9d542c5f82 Mon Sep 17 00:00:00 2001
From: J0WI <J0WI@users.noreply.github.com>
Date: Wed, 3 Jan 2018 15:40:10 +0100
Subject: [PATCH 2/2] Normalize securecookie rule

---
 src/chrome/content/rules/MIT.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/chrome/content/rules/MIT.xml b/src/chrome/content/rules/MIT.xml
index 0088a211bba1..b9d882620a53 100644
--- a/src/chrome/content/rules/MIT.xml
+++ b/src/chrome/content/rules/MIT.xml
@@ -233,7 +233,7 @@
 	<target host="whereis.mit.edu" />
 	<target host="wikis.mit.edu" />
 
-	<securecookie host="^(?!calendars\.mit\.edu$)\w" name="." />
+	<securecookie host="^(?!calendars\.mit\.edu$)\w" name=".+" />
 	<securecookie host="^\." name="^__utm" />
 
 	<rule from="^http://csail\.mit\.edu/" to="https://www.csail.mit.edu/" />