Don't block HSTS requests in HTTP Nowhere mode

yan · yan · commit e0abd5109490 · 2015-03-21T15:27:38.000-07:00
diff --git a/src/chrome/content/code/HTTPS.js b/src/chrome/content/code/HTTPS.js
@@ -1,5 +1,8 @@
 INCLUDE('Cookie');
 
+var securityService = CC['@mozilla.org/ssservice;1']
+    .getService(CI.nsISiteSecurityService);
+
 // Hack. We only need the part of the policystate that tracks content
 // policy loading.
 const PolicyState = {
@@ -37,9 +40,11 @@ const HTTPS = {
    */
   replaceChannel: function(applicable_list, channel, httpNowhereEnabled) {
     var blob = HTTPSRules.rewrittenURI(applicable_list, channel.URI.clone());
+    var isSTS = securityService.isSecureURI(
+        CI.nsISiteSecurityService.HEADER_HSTS, channel.URI, 0);
     if (blob === null) {
       // Abort insecure requests if HTTP Nowhere is on
-      if (httpNowhereEnabled && channel.URI.schemeIs("http")) {
+      if (httpNowhereEnabled && channel.URI.schemeIs("http") && !isSTS) {
         IOUtil.abort(channel);
       }
       return false; // no rewrite
