If CSP already existed, modify it insteads

EFForg · Feb 13, 2018 · 1e06bf1 · 1e06bf1
1 parent 0d1f114
commit 1e06bf1
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/chromium/background.js b/chromium/background.js
@@ -503,6 +503,20 @@ function onErrorOccurred(details) {
  */
 function onHeadersReceived(details) {
   if (isExtensionEnabled && httpNowhereOn) {
+    for (const idx in details.responseHeaders) {
+      if (details.responseHeaders[idx].name.match(/Content-Security-Policy/i)) {
+        // Existing CSP headers found
+        const value = details.responseHeaders[idx].value;
+
+        // Prepend if no upgrade-insecure-requests directive exists
+        if (!value.match(/upgrade-insecure-requests/i)) {
+          details.responseHeaders[idx].value = "upgrade-insecure-requests; " + value;
+        }
+        return {responseHeaders: details.responseHeaders};
+      }
+    }
+
+    // CSP headers not found
     const upgradeInsecureRequests = {
       name: 'Content-Security-Policy',
       value: 'upgrade-insecure-requests'