We still have several bits of code that call SetScheme(NS_LITERAL_CSTRING("https")); on an http-flavored nsIURI, to upgrade it to HTTPS. Depending on how these URIs are used, they're all potentially at risk of failing equality comparisons against other URIs that they should really be equal to. (More things like bug 1247733, basically.) Really, we shouldn't have any hardcoded SetScheme calls -- we should use the newly-improved HttpBaseChannel::GetSecureUpgradedURI function. (improved in bug 1247733) Based on an MXR search[1], I think there are two places that need this treatment: http://mxr.mozilla.org/mozilla-central/source/dom/html/HTMLFormElement.cpp?rev=0a5df57a56e4#1753 http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/nsHttpHandler.cpp?rev=28069d20b125#2178 The MXR search I used for this audit was: http://mxr.mozilla.org/mozilla-central/search?string=SetScheme.*https&regexp=1&find=&findi=&filter=^[^\0]*%24 ...which turns up 4 hits -- the above-linked 2 places, plus the SetScheme call in HttpBaseChannel::GetSecureUpgradedURI (which is now OK), plus one websocket SetScheme call which only happens for "wss" URIs (which should also be OK from the perspective of this bug -- they should already have the correct mDefaultPort I believe).

This first patch just moves this upgrade-URI-to-https function from its current location to nsNetUtil, for broader availability. (It only lives in HttpBaseChannel for historical reasons, I think.) (We need this part because we can't #include HttpBaseChannel.h at the dom/html/HTMLFormElement.cpp callsite, because HttpBaseChannel.h itself has an #include for some other header which is not exported.)

Comment on attachment 8728660 [details] [diff] [review] part 1: move GetSecureUpgradedURI to nsNetUtil (no functional changes) Review of attachment 8728660 [details] [diff] [review]: ----------------------------------------------------------------- thanks for this. lgtm

https://hg.mozilla.org/integration/mozilla-inbound/rev/9782ea9f33da https://hg.mozilla.org/integration/mozilla-inbound/rev/0c1e74f83b41

https://hg.mozilla.org/mozilla-central/rev/9782ea9f33da https://hg.mozilla.org/mozilla-central/rev/0c1e74f83b41