Bug 1658594: Simplified HTTPS-Only checks for CORS and mixed content …

…r=ckerschb

Differential Revision: https://phabricator.services.mozilla.com/D86820

dom/security/nsHTTPSOnlyUtils.cpp

@@ -268,6 +268,18 @@ void nsHTTPSOnlyUtils::TestSitePermissionAndPotentiallyAddExemption(
   loadInfo->SetHttpsOnlyStatus(httpsOnlyStatus);
 }
 
+/* static */
+bool nsHTTPSOnlyUtils::IsSafeToAcceptCORSOrMixedContent(
+    nsILoadInfo* aLoadInfo) {
+  // Check if the request is exempt from upgrades
+  if ((aLoadInfo->GetHttpsOnlyStatus() & nsILoadInfo::HTTPS_ONLY_EXEMPT)) {
+    return false;
+  }
+  // Check if HTTPS-Only Mode is enabled for this request
+  bool isPrivateWin = aLoadInfo->GetOriginAttributes().mPrivateBrowsingId > 0;
+  return nsHTTPSOnlyUtils::IsHttpsOnlyModeEnabled(isPrivateWin);
+}
+
 /* ------ Logging ------ */
 
 /* static */

dom/security/nsHTTPSOnlyUtils.h

@@ -79,6 +79,14 @@ class nsHTTPSOnlyUtils {
   static void TestSitePermissionAndPotentiallyAddExemption(
       nsIChannel* aChannel);
 
+  /**
+   * Checks whether CORS or mixed content requests are safe because they'll get
+   * upgraded to HTTPS
+   * @param  aLoadInfo nsILoadInfo of request
+   * @return           true if it's safe to accept
+   */
+  static bool IsSafeToAcceptCORSOrMixedContent(nsILoadInfo* aLoadInfo);
+
  private:
   /**
    * Logs localized message to either content console or browser console

dom/security/nsMixedContentBlocker.cpp

@@ -645,9 +645,8 @@ nsresult nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
     return NS_OK;
   }
 
-  // If https-only mode is enabled we'll upgrade this later anyway
-  bool isPrivateWin = aLoadInfo->GetOriginAttributes().mPrivateBrowsingId > 0;
-  if (nsHTTPSOnlyUtils::IsHttpsOnlyModeEnabled(isPrivateWin)) {
+  // Check if https-only mode upgrades this later anyway
+  if (nsHTTPSOnlyUtils::IsSafeToAcceptCORSOrMixedContent(aLoadInfo)) {
     *aDecision = ACCEPT;
     return NS_OK;
   }

netwerk/protocol/http/nsCORSListenerProxy.cpp

@@ -892,11 +892,9 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel,
   // then the xhr request will be upgraded to https before it fetches any data
   // from the netwerk, hence we shouldn't require CORS in that specific case.
   if (CheckInsecureUpgradePreventsCORS(mRequestingPrincipal, aChannel)) {
-    // Check if HTTPS-Only Mode is enabled
+    // Check if https-only mode upgrades this later anyway
     nsCOMPtr<nsILoadInfo> loadinfo = aChannel->LoadInfo();
-    bool isPrivateWin = loadinfo->GetOriginAttributes().mPrivateBrowsingId > 0;
-    if (!(loadInfo->GetHttpsOnlyStatus() & nsILoadInfo::HTTPS_ONLY_EXEMPT) &&
-        nsHTTPSOnlyUtils::IsHttpsOnlyModeEnabled(isPrivateWin)) {
+    if (nsHTTPSOnlyUtils::IsSafeToAcceptCORSOrMixedContent(loadinfo)) {
       return NS_OK;
     }
     // Check if 'upgrade-insecure-requests' is used