Skip to content
This repository was archived by the owner on Nov 6, 2023. It is now read-only.

Fix some CORS issues in HTTP Nowhere mode #15606

Merged
Hainish merged 2 commits into from
Jun 7, 2018
Merged

Fix some CORS issues in HTTP Nowhere mode #15606

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7934d51
Fix some CORS issues in HTTP Nowhere mode
Jun 3, 2018
6359b43
Add RegExp global search flag
Jun 3, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 30 additions & 9 deletions chromium/background-scripts/background.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,7 +579,8 @@ function onErrorOccurred(details) {
}

/**
* handle webrequest.onHeadersReceived, insert upgrade-insecure-requests directive
* handle webrequest.onHeadersReceived, insert upgrade-insecure-requests directive and
* rewrite access-control-allow-origin if presented in HTTP Nowhere mode
* @param details details for the chrome.webRequest (see chrome doc)
*/
function onHeadersReceived(details) {
Expand All @@ -591,27 +592,47 @@ function onHeadersReceived(details) {
return {};
}

let responseHeadersChanged = false;
let cspHeaderFound = false;

for (const idx in details.responseHeaders) {
if (details.responseHeaders[idx].name.match(/Content-Security-Policy/i)) {
// Existing CSP headers found
cspHeaderFound = true;
const value = details.responseHeaders[idx].value;

// Prepend if no upgrade-insecure-requests directive exists
if (!value.match(/upgrade-insecure-requests/i)) {
details.responseHeaders[idx].value = "upgrade-insecure-requests; " + value;
return {responseHeaders: details.responseHeaders};
responseHeadersChanged = true;
}
return {};
}

if (details.responseHeaders[idx].name.match(/Access-Control-Allow-Origin/i)) {
// Existing access-control-allow-origin header found
const value = details.responseHeaders[idx].value;

// If HTTP protocol is used, change it to HTTPS
if (value.match(/http:/)) {
details.responseHeaders[idx].value = value.replace(/http:/g, "https:");

@ghost ghost Jun 6, 2018

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if one of the URLs has http: in the middle?

responseHeadersChanged = true;
}
}
}

if (!cspHeaderFound) {
// CSP headers not found
const upgradeInsecureRequests = {
name: 'Content-Security-Policy',
value: 'upgrade-insecure-requests'
}
details.responseHeaders.push(upgradeInsecureRequests);
responseHeadersChanged = true;
}

// CSP headers not found
const upgradeInsecureRequests = {
name: 'Content-Security-Policy',
value: 'upgrade-insecure-requests'
if (responseHeadersChanged) {
return {responseHeaders: details.responseHeaders};
}
details.responseHeaders.push(upgradeInsecureRequests);
return {responseHeaders: details.responseHeaders};
}
return {};
}
Expand Down