From 7934d518265556ec4c3b09280d41d512f8862b05 Mon Sep 17 00:00:00 2001
From: Pasu Chan Chak Shing <ccspasu@gmail.com>
Date: Sun, 3 Jun 2018 18:28:51 +0800
Subject: [PATCH 1/2] Fix some CORS issues in HTTP Nowhere mode

 * Rewrite access-control-allow-origin to avoid the HTTP protocol in
HTTP Nowhere mode
---
 chromium/background-scripts/background.js | 39 +++++++++++++++++------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/chromium/background-scripts/background.js b/chromium/background-scripts/background.js
index 40ccdd146784..347309ad08a7 100644
--- a/chromium/background-scripts/background.js
+++ b/chromium/background-scripts/background.js
@@ -579,7 +579,8 @@ function onErrorOccurred(details) {
 }
 
 /**
- * handle webrequest.onHeadersReceived, insert upgrade-insecure-requests directive
+ * handle webrequest.onHeadersReceived, insert upgrade-insecure-requests directive and
+ * rewrite access-control-allow-origin if presented in HTTP Nowhere mode
  * @param details details for the chrome.webRequest (see chrome doc)
  */
 function onHeadersReceived(details) {
@@ -591,27 +592,47 @@ function onHeadersReceived(details) {
       return {};
     }
 
+    let responseHeadersChanged = false;
+    let cspHeaderFound = false;
+
     for (const idx in details.responseHeaders) {
       if (details.responseHeaders[idx].name.match(/Content-Security-Policy/i)) {
         // Existing CSP headers found
+        cspHeaderFound = true;
         const value = details.responseHeaders[idx].value;
 
         // Prepend if no upgrade-insecure-requests directive exists
         if (!value.match(/upgrade-insecure-requests/i)) {
           details.responseHeaders[idx].value = "upgrade-insecure-requests; " + value;
-          return {responseHeaders: details.responseHeaders};
+          responseHeadersChanged = true;
         }
-        return {};
       }
+
+      if (details.responseHeaders[idx].name.match(/Access-Control-Allow-Origin/i)) {
+        // Existing access-control-allow-origin header found
+        const value = details.responseHeaders[idx].value;
+
+        // If HTTP protocol is used, change it to HTTPS
+        if (value.match(/http:/)) {
+          details.responseHeaders[idx].value = value.replace(/http:/, "https:");
+          responseHeadersChanged = true;
+        }
+      }
+    }
+
+    if (!cspHeaderFound) {
+      // CSP headers not found
+      const upgradeInsecureRequests = {
+        name: 'Content-Security-Policy',
+        value: 'upgrade-insecure-requests'
+      }
+      details.responseHeaders.push(upgradeInsecureRequests);
+      responseHeadersChanged = true;
     }
 
-    // CSP headers not found
-    const upgradeInsecureRequests = {
-      name: 'Content-Security-Policy',
-      value: 'upgrade-insecure-requests'
+    if (responseHeadersChanged) {
+      return {responseHeaders: details.responseHeaders};
     }
-    details.responseHeaders.push(upgradeInsecureRequests);
-    return {responseHeaders: details.responseHeaders};
   }
   return {};
 }

From 6359b43bf98b99b1a3b0103749ee9b5741863405 Mon Sep 17 00:00:00 2001
From: Pasu Chan Chak Shing <ccspasu@gmail.com>
Date: Sun, 3 Jun 2018 18:41:41 +0800
Subject: [PATCH 2/2] Add RegExp global search flag

---
 chromium/background-scripts/background.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chromium/background-scripts/background.js b/chromium/background-scripts/background.js
index 347309ad08a7..d3925835f95f 100644
--- a/chromium/background-scripts/background.js
+++ b/chromium/background-scripts/background.js
@@ -614,7 +614,7 @@ function onHeadersReceived(details) {
 
         // If HTTP protocol is used, change it to HTTPS
         if (value.match(/http:/)) {
-          details.responseHeaders[idx].value = value.replace(/http:/, "https:");
+          details.responseHeaders[idx].value = value.replace(/http:/g, "https:");
           responseHeadersChanged = true;
         }
       }