[Tor] Treat .onion sites whose protocol is HTTP as if it was HTTPS.

src/bg/Settings.js

@@ -92,6 +92,8 @@ var Settings = {
       // Tor Browser-specific settings
       ns.defaults.local.isTorBrowser = true; // prevents reset from forgetting
       ns.defaults.sync.cascadeRestrictions = true; // we want this to be the default even on reset
+      Sites.onionSecure = true;
+
       if (!this.gotTorBrowserInit) {
         // First initialization message from the Tor Browser
         this.gotTorBrowserInit = true;

src/common/Policy.js

@@ -65,6 +65,9 @@ var {Permissions, Policy, Sites} = (() => {
         }
       }
       if (url) {
+        if (Sites.onionSecure && url.protocol === "http:" && url.hostname.endsWith(".onion")) {
+          url.protocol = "https:";
+        }
         let path = url.pathname;
         siteKey = url.origin;
         if (siteKey === "null") {

src/ui/ui.js

@@ -38,11 +38,15 @@ var UI = (() => {
             UI.xssUserChoices = m.xssUserChoices;
             UI.local = m.local;
             UI.sync = m.sync;
-            if (UI.local && !UI.local.debug) {
+
+            if (UI.local) {
+              if (!UI.local.debug) {
                 debug = () => {}; // be quiet!
               }
-            if (UI.local) {
               document.documentElement.classList.toggle("tor", !!UI.local.isTorBrowser);
+              if (UI.local.isTorBrowser) {
+                Sites.onionSecure = true;
+              }
             }
             resolve();
             if (UI.onSettings) UI.onSettings();