Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=JuniorHsu

Differential Revision: https://phabricator.services.mozilla.com/D54303

--HG--
extra : moz-landing-system : lando

dom/security/ReferrerInfo.cpp

@@ -401,6 +401,14 @@ bool ReferrerInfo::ShouldSetNullOriginHeader(net::HttpBaseChannel* aChannel,
   MOZ_ASSERT(aChannel);
   MOZ_ASSERT(aOriginURI);
 
+  if (StaticPrefs::network_http_referer_hideOnionSource()) {
+    nsAutoCString host;
+    if (NS_SUCCEEDED(aOriginURI->GetAsciiHost(host)) &&
+        StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) {
+      return ReferrerInfo::IsCrossOriginRequest(aChannel);
+    }
+  }
+
   // When we're dealing with CORS (mode is "cors"), we shouldn't take the
   // Referrer-Policy into account
   uint32_t corsMode = CORS_NONE;

netwerk/protocol/http/nsCORSListenerProxy.cpp

@@ -981,7 +981,7 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel,
 
     if (!currentOrgin.EqualsIgnoreCase(origin.get()) &&
         StringEndsWith(potentialOnionHost, NS_LITERAL_CSTRING(".onion"))) {
-      origin.Truncate();
+      origin.AssignLiteral("null");
     }
   }
 

netwerk/protocol/http/nsHttpChannel.cpp

@@ -9776,17 +9776,6 @@ void nsHttpChannel::SetOriginHeader() {
       // Origin header suppressed by user setting
       return;
     }
-  } else if (StaticPrefs::network_http_referer_hideOnionSource()) {
-    nsAutoCString host;
-    if (referrer && NS_SUCCEEDED(referrer->GetAsciiHost(host)) &&
-        StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) {
-      nsAutoCString currentOrigin;
-      nsContentUtils::GetASCIIOrigin(mURI, currentOrigin);
-      if (!origin.EqualsIgnoreCase(currentOrigin.get())) {
-        // Origin header is suppressed by .onion
-        return;
-      }
-    }
   }
 
   if (ReferrerInfo::ShouldSetNullOriginHeader(this, referrer)) {