EFForg · 555 · Jun 21, 2018 · Jun 21, 2018 · Jun 21, 2018 · Jun 21, 2018
diff --git a/chromium/background-scripts/background.js b/chromium/background-scripts/background.js
@@ -276,6 +276,12 @@ var urlBlacklist = new Set();
 // TODO: Remove this code if they ever give us a real counter
 var redirectCounter = new Map();
 
+const cancelUrl = chrome.extension.getURL("/pages/cancel/index.html");
+
+function redirectOnCancel(shouldCancel){
+  return shouldCancel ? {redirectUrl: cancelUrl} : {cancel: false};
+}
+
 /**
  * Called before a HTTP(s) request. Does the heavy lifting
  * Cancels the request/redirects it to HTTPS. URL modification happens in here.
@@ -298,7 +304,7 @@ function onBeforeRequest(details) {
   // true if the URL is a http:// connection to a remote canonical host, and not
   // a tor hidden service
   const shouldCancel = httpNowhereOn &&
-    uri.protocol === 'http:' &&
+    (uri.protocol === 'http:' || uri.protocol === 'ftp:') &&
     uri.hostname.slice(-6) !== '.onion' &&
     uri.hostname !== 'localhost' &&
     !/^127(\.[0-9]{1,3}){3}$/.test(uri.hostname) &&
@@ -323,7 +329,7 @@ function onBeforeRequest(details) {
         " changed before processing to " + uri.href);
   }
   if (urlBlacklist.has(uri.href)) {
-    return {cancel: shouldCancel};
+    return redirectOnCancel(shouldCancel);
   }
 
   if (details.type == "main_frame") {
@@ -337,7 +343,7 @@ function onBeforeRequest(details) {
     urlBlacklist.add(uri.href);
     rules.settings.domainBlacklist.add(uri.hostname);
     util.log(util.WARN, "Domain blacklisted " + uri.hostname);
-    return {cancel: shouldCancel};
+    return redirectOnCancel(shouldCancel);
   }
 
   // whether to use mozilla's upgradeToSecure BlockingResponse if available
@@ -393,9 +399,15 @@ function onBeforeRequest(details) {
         newuristr = newuristr.replace(/^http:/, "https:");
       }
     }
-    if (newuristr && newuristr.substring(0, 5) === "http:") {
-      // Abort early if we're about to redirect to HTTP in HTTP Nowhere mode
-      return {cancel: true};
+    if (
+      newuristr &&
+      (
+        newuristr.substring(0, 5) === "http:" ||
+        newuristr.substring(0, 4) === "ftp:"
+      )
+    ) {
+      // Abort early if we're about to redirect to HTTP or FTP in HTTP Nowhere mode
+      return {redirectUrl: cancelUrl};
     }
   }
 
@@ -407,7 +419,7 @@ function onBeforeRequest(details) {
     return {redirectUrl: newuristr};
   } else {
     util.log(util.INFO, 'onBeforeRequest returning shouldCancel: ' + shouldCancel);
-    return {cancel: shouldCancel};
+    return redirectOnCancel(shouldCancel);
   }
 }
 
@@ -636,7 +648,7 @@ function onHeadersReceived(details) {
 
 // Registers the handler for requests
 // See: https://github.com/EFForg/https-everywhere/issues/10039
-chrome.webRequest.onBeforeRequest.addListener(onBeforeRequest, {urls: ["*://*/*"]}, ["blocking"]);
+chrome.webRequest.onBeforeRequest.addListener(onBeforeRequest, {urls: ["*://*/*", "ftp://*/*"]}, ["blocking"]);
 
 // Try to catch redirect loops on URLs we've redirected to HTTPS.
 chrome.webRequest.onBeforeRedirect.addListener(onBeforeRedirect, {urls: ["https://*/*"]});

diff --git a/chromium/background-scripts/update.js b/chromium/background-scripts/update.js
@@ -1,32 +1,24 @@
-/* global update_channels */
 /* global pako */
-/* global __dirname */
 
 "use strict";
 
 // Determine if we're in the tests.  If so, define some necessary components.
-if(typeof(window) == "undefined"){
-  const fs = require('fs');
-  const WebCrypto = require("node-webcrypto-ossl"),
+if (typeof window === "undefined") {
+  var WebCrypto = require("node-webcrypto-ossl"),
+    crypto = new WebCrypto(),
     atob = require("atob"),
     btoa = require("btoa"),
-    encoding = require('text-encoding');
-
-  var window = {
-    crypto: new WebCrypto(),
-    atob,
-    btoa
-  };
-
-  var update_channels = Function(fs.readFileSync(__dirname + '/update_channels.js').toString() + "return update_channels;")(),
-    pako = Function(fs.readFileSync(__dirname + '/../external/pako-1.0.5/pako_inflate.min.js').toString() + "return pako;")(),
-    TextDecoder = encoding.TextDecoder,
-    chrome = require("sinon-chrome");
+    pako = require('../external/pako-1.0.5/pako_inflate.min.js'),
+    { TextDecoder } = require('text-encoding'),
+    chrome = require("sinon-chrome"),
+    window = { atob, btoa, chrome, crypto, pako, TextDecoder };
 }
 
 (function(exports) {
 
+const { update_channels } = require('./update_channels');
 const util = require('./util');
+
 let store,
   background_callback;
 

diff --git a/chromium/background-scripts/update_channels.js b/chromium/background-scripts/update_channels.js
@@ -1,13 +1,23 @@
 /* exported update_channels */
 
-"use strict";
+'use strict';
 
-var update_channels = [{
-  name: "EFF (Full)",
+(function (exports) {
+
+exports.update_channels = [{
+  name: 'EFF (Full)',
   jwk: {
-    kty: "RSA",
-    e: "AQAB",
-    n: "1cwvFQu3Kw-Pz8bcEFuV5zx0ZheDsc4Tva7Qv6BL90_sDLqCW79Y543nDkPtNVfFH_89pt2kSPp_IcS5XnYiw6zBQeFuILFw5JpvZt14K0s4e025Q9CXfhYKIBKT9PnqihwAacjMa6rQb7RTu7XxVvqxRb3b0vx2CR40LSlYZ8H_KpeaUwq2oz-fyrI6LFTeYvbO3ZuLKeK5xV1a32xeTVMFkIj3LxnQalxq-DRHfj7LRRoTnbRDW4uoDc8aVpLFliuO79jUKbobz4slpiWJ4wjKR_O6OK13HbZUiOSxi8Bms-UqBPOyzbMVpmA7lv_zWdaLu1IVlVXQyLVbbrqI6llRqfHdcJoEl-eC48AofuB-relQtjTEK_hyBf7sPwrbqAarjRjlyEx6Qy5gTXyxM9attfNAeupYR6jm8LKm6TFpfWkyDxUmj_f5pJMBWNTomV74f8iQ2M18_KWMUDCOf80tR0t21Q1iCWdvA3K_KJn05tTLyumlwwlQijMqRkYuao-CX9L3DJIaB3VPYPTSIPUr7oi16agsuamOyiOtlZiRpEvoNg2ksJMZtwnj5xhBQydkdhMW2ZpHDzcLuZlhJYZL_l3_7wuzRM7vpyA9obP92CpZRFJErGZmFxJC93I4U9-0B0wg-sbyMKGJ5j1BWTnibCklDXtWzXtuiz18EgE"
+    kty: 'RSA',
+    e: 'AQAB',
+    n: '1cwvFQu3Kw-Pz8bcEFuV5zx0ZheDsc4Tva7Qv6BL90_sDLqCW79Y543nDkPtNVfFH_89pt2kSPp_IcS5XnYiw6zBQeFuILFw5JpvZt14K0s4' +
+       'e025Q9CXfhYKIBKT9PnqihwAacjMa6rQb7RTu7XxVvqxRb3b0vx2CR40LSlYZ8H_KpeaUwq2oz-fyrI6LFTeYvbO3ZuLKeK5xV1a32xeTVMF' +
+       'kIj3LxnQalxq-DRHfj7LRRoTnbRDW4uoDc8aVpLFliuO79jUKbobz4slpiWJ4wjKR_O6OK13HbZUiOSxi8Bms-UqBPOyzbMVpmA7lv_zWdaL' +
+       'u1IVlVXQyLVbbrqI6llRqfHdcJoEl-eC48AofuB-relQtjTEK_hyBf7sPwrbqAarjRjlyEx6Qy5gTXyxM9attfNAeupYR6jm8LKm6TFpfWky' +
+       'DxUmj_f5pJMBWNTomV74f8iQ2M18_KWMUDCOf80tR0t21Q1iCWdvA3K_KJn05tTLyumlwwlQijMqRkYuao-CX9L3DJIaB3VPYPTSIPUr7oi1' +
+       '6agsuamOyiOtlZiRpEvoNg2ksJMZtwnj5xhBQydkdhMW2ZpHDzcLuZlhJYZL_l3_7wuzRM7vpyA9obP92CpZRFJErGZmFxJC93I4U9-0B0wg' +
+       '-sbyMKGJ5j1BWTnibCklDXtWzXtuiz18EgE'
   },
-  update_path_prefix: "https://www.https-rulesets.org/v1/"
+  update_path_prefix: 'https://www.https-rulesets.org/v1/'
 }];
+
+})(typeof exports === 'undefined' ? require.scopes.update_channels = {} : exports);
diff --git a/chromium/images/banner-red.png b/chromium/images/banner-red.png
diff --git a/chromium/manifest.json b/chromium/manifest.json
@@ -19,6 +19,9 @@
             "background-scripts/background.js"
         ]
     },
+    "web_accessible_resources": [
+        "/pages/cancel/index.html"
+    ],
     "browser_action": {
         "default_icon": {
             "38": "images/icons/icon-active-38.png"
@@ -48,7 +51,8 @@
         "tabs",
         "cookies",
         "storage",
-        "*://*/*"
+        "*://*/*",
+        "ftp://*/*"
     ],
     "version": "2018.6.21"
-}
+}
diff --git a/chromium/pages/cancel/index.html b/chromium/pages/cancel/index.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta http-equiv="Content-Style-Type" content="text/css" />
+    <title>⚠ HTTPS Everywhere ⚠</title>
+    <style type="text/css">code{white-space: pre;}</style>
+    <link rel="stylesheet" href="style.css" type="text/css" />
+  </head>
+  <body>
+    <h1 id="https-everywhere"><img src="../../images/banner-red.png" alt="HTTPS Everywhere" /></h1>
+    <p data-i18n="cancel_he_blocking_explainer"></p>
+    <script src="../translation.js"></script>
+    <script src="ux.js"></script>
+  </body>
+</html>
diff --git a/chromium/pages/cancel/style.css b/chromium/pages/cancel/style.css
@@ -0,0 +1,20 @@
+body{
+  margin-top: 6em;
+  left: 50%;
+  position: relative;
+  overflow: hidden;
+}
+
+h1 img{
+  position: relative;
+  left: -289px;
+}
+
+p{
+  width: 600px;
+  position: relative;
+  left: -300px;
+  font-size: 12pt;
+  font-family: sans-serif;
+  line-height: 150%;
+}
diff --git a/chromium/pages/cancel/ux.js b/chromium/pages/cancel/ux.js
@@ -0,0 +1,21 @@
+"use strict";
+
+let observer;
+document.addEventListener("DOMContentLoaded", () => {
+  const explainer = document.querySelector("[data-i18n=cancel_he_blocking_explainer]");
+  observer = new MutationObserver(() => {replaceLink(explainer)});
+  if (explainer.innerText.length > 0) {
+    replaceLink(explainer);
+  } else {
+    observer.observe(explainer, {childList: true});
+  }
+});
+
+function replaceLink(explainer){
+  observer.disconnect();
+  const linkText = chrome.i18n.getMessage("cancel_he_blocking_network");
+  const link = document.createElement("a");
+  link.href = "https://en.wikipedia.org/wiki/Downgrade_attack";
+  link.innerText = linkText;
+  explainer.innerHTML = explainer.innerHTML.replace(linkText, link.outerHTML);
+}
diff --git a/chromium/test/update_test.js b/chromium/test/update_test.js
@@ -9,8 +9,8 @@ const assert = require('chai').assert,
   sinon = require('sinon');
 
 const fs = require('fs'),
-  update_channels = Function(fs.readFileSync(__dirname + '/../background-scripts/update_channels.js').toString() + "return update_channels;")(),
-  pako = Function(fs.readFileSync(__dirname + '/../external/pako-1.0.5/pako_inflate.min.js').toString() + "return pako;")();
+  { update_channels } = require('../background-scripts/update_channels'),
+  pako = require('../external/pako-1.0.5/pako_inflate.min.js');
 
 util.setDefaultLogLevel(util.WARN);
 

diff --git a/make.sh b/make.sh
@@ -84,9 +84,9 @@ fi
 # If the --remove-update-channels flag is set, remove all out-of-band update channels
 if [ "$1" == "--remove-update-channels" -o "$2" == "--remove-update-channels" -o "$3" == "--remove-update-channels" ]; then
   echo "Flag --remove-update-channels specified.  Removing all out-of-band update channels."
-  echo "update_channels = [];" >> pkg/crx/background-scripts/update_channels.js
-  echo "update_channels = [];" >> pkg/xpi-amo/background-scripts/update_channels.js
-  echo "update_channels = [];" >> pkg/xpi-eff/background-scripts/update_channels.js
+  echo "require.scopes.update_channels.update_channels = [];" >> pkg/crx/background-scripts/update_channels.js
+  echo "require.scopes.update_channels.update_channels = [];" >> pkg/xpi-amo/background-scripts/update_channels.js
+  echo "require.scopes.update_channels.update_channels = [];" >> pkg/xpi-eff/background-scripts/update_channels.js
 fi
 
 if [ -n "$BRANCH" ] ; then

diff --git a/src/chrome/content/rules/1.0.0.1.xml b/src/chrome/content/rules/1.0.0.1.xml
@@ -1,16 +1,12 @@
 <!--
-	Other CloudFlare rulesets:
-
-		- CloudFlare.xml
-
+	Other Cloudflare rulesets:
+		- Cloudflare.com.xml
 -->
-<ruleset name="1.0.0.1">
 
+<ruleset name="1.0.0.1">
 	<target host="1.0.0.1" />
 
 	<securecookie host=".+" name=".+" />
 
-	<rule from="^http:"
-		to="https:" />
-
+	<rule from="^http:" to="https:" />
 </ruleset>
diff --git a/src/chrome/content/rules/1.1.1.1.xml b/src/chrome/content/rules/1.1.1.1.xml
@@ -1,16 +1,12 @@
 <!--
-	Other CloudFlare rulesets:
-
-		- CloudFlare.xml
-
+	Other Cloudflare rulesets:
+		- Cloudflare.com.xml
 -->
-<ruleset name="1.1.1.1">
 
+<ruleset name="1.1.1.1">
 	<target host="1.1.1.1" />
 
 	<securecookie host=".+" name=".+" />
 
-	<rule from="^http:"
-		to="https:" />
-
+	<rule from="^http:" to="https:" />
 </ruleset>
diff --git a/src/chrome/content/rules/ARICR.org.xml b/src/chrome/content/rules/ARICR.org.xml
@@ -0,0 +1,8 @@
+<ruleset name="ARICR.org">
+	<target host="aricr.org" />
+	<target host="www.aricr.org" />
+
+	<securecookie host=".+" name=".+" />
+
+	<rule from="^http:" to="https:" />
+</ruleset>
diff --git a/src/chrome/content/rules/Adbooth.net.xml b/src/chrome/content/rules/Adbooth.net.xml
@@ -38,7 +38,7 @@
 
 
 	<rule from="^http://cdn\.adbooth\.net/"
-		to="https://s3.amazonaws.com/cdn.adbooth.net/" />
+		to="https://cdn.adbooth.net/" />
 
 	<rule from="^http://help\.adbooth\.net/track\.gif"
 		to="https://cdn.uservoice.com/track.gif" />

diff --git a/src/chrome/content/rules/Adk2.xml b/src/chrome/content/rules/Adk2.xml
@@ -36,6 +36,6 @@ Fetch error: http://adk2.com/ => https://adk2.com/: (60, 'SSL certificate proble
 	<!--	Included on 3rd-party websites.
 						-->
 	<rule from="^http://cdn\.adk2\.com/"
-		to="https://d38cp5x90nxyo0.cloudfront.net/" />
+		to="https://cdn.adk2.com/" />
 
 </ruleset>
diff --git a/src/chrome/content/rules/Adspdbl.com.xml b/src/chrome/content/rules/Adspdbl.com.xml
@@ -17,7 +17,6 @@
 	<target host="files.adspdbl.com" />
 
 
-	<rule from="^http://files\.adspdbl\.com/"
-		to="https://d3ijm230svej28.cloudfront.net/" />
+	<rule from="^http:" to="https:" />
 
 </ruleset>