[tbb-commits] [tor-browser/tor-browser-68.2.0esr-9.5-1] Bug 32255: Set Origin to null for CORS requests

[gk at torproject.org]

commit f26fb9c17d71f3373c8ccb91ae74c438d9e13f80
Author: Alex Catarineu <acat at torproject.org>
Date:   Thu Nov 21 19:28:54 2019 +0100

    Bug 32255: Set Origin to null for CORS requests
---
 netwerk/protocol/http/nsCORSListenerProxy.cpp | 2 +-
 netwerk/protocol/http/nsHttpChannel.cpp       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/netwerk/protocol/http/nsCORSListenerProxy.cpp
index 36b263ddf003..36027a5d2809 100644
--- a/netwerk/protocol/http/nsCORSListenerProxy.cpp
+++ b/netwerk/protocol/http/nsCORSListenerProxy.cpp
@@ -985,7 +985,7 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel,
 
     if (!currentOrgin.EqualsIgnoreCase(origin.get()) &&
         StringEndsWith(potentialOnionHost, NS_LITERAL_CSTRING(".onion"))) {
-      origin.Truncate();
+      origin.AssignLiteral("null");
     }
   }
 
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index b2d58379affe..362607d113ca 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -9647,8 +9647,8 @@ void nsHttpChannel::SetOriginHeader() {
       nsAutoCString currentOrigin;
       nsContentUtils::GetASCIIOrigin(mURI, currentOrigin);
       if (!origin.EqualsIgnoreCase(currentOrigin.get())) {
-        // Origin header is suppressed by .onion
-        return;
+        // Origin header set to null by .onion
+        origin.AssignLiteral("null");
       }
     }
   }