Updated extensions list for v60

8 files changed, 2176 insertions, 0 deletions

diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/background.js b/data/extensions/https-everywhere@eff.org/background-scripts/background.js
new file mode 100644
index 0000000..8a82be3
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/background.js
@@ -0,0 +1,905 @@
+"use strict";
+
+(function(exports) {
+
+const rules = require('./rules'),
+  store = require('./store'),
+  incognito = require('./incognito'),
+  util = require('./util'),
+  update = require('./update'),
+  { update_channels } = require('./update_channels');
+
+
+let all_rules = new rules.RuleSets();
+
+async function initialize() {
+  await store.initialize();
+  await store.performMigrations();
+  await initializeStoredGlobals();
+  await getUpgradeToSecureAvailable();
+  await update.initialize(store, initializeAllRules);
+  await all_rules.loadFromBrowserStorage(store, update.applyStoredRulesets);
+  await incognito.onIncognitoDestruction(destroy_caches);
+}
+initialize();
+
+async function initializeAllRules() {
+  const r = new rules.RuleSets();
+  await r.loadFromBrowserStorage(store, update.applyStoredRulesets);
+  Object.assign(all_rules, r);
+}
+
+/**
+ * Load preferences. Structure is:
+ *  {
+ *    httpNowhere: Boolean,
+ *    showCounter: Boolean,
+ *    isExtensionEnabled: Boolean
+ *  }
+ */
+var httpNowhereOn = false;
+var showCounter = true;
+var isExtensionEnabled = true;
+
+function initializeStoredGlobals(){
+  return new Promise(resolve => {
+    store.get({
+      httpNowhere: false,
+      showCounter: true,
+      globalEnabled: true,
+      enableMixedRulesets: false
+    }, function(item) {
+      httpNowhereOn = item.httpNowhere;
+      showCounter = item.showCounter;
+      isExtensionEnabled = item.globalEnabled;
+      updateState();
+
+      rules.settings.enableMixedRulesets = item.enableMixedRulesets;
+
+      resolve();
+    });
+  });
+}
+
+let upgradeToSecureAvailable;
+
+function getUpgradeToSecureAvailable() {
+  if (typeof browser !== 'undefined') {
+    return browser.runtime.getBrowserInfo().then(function(info) {
+      let version = info.version.match(/^(\d+)/)[1];
+      if (info.name == "Firefox" && version >= 59) {
+        upgradeToSecureAvailable = true;
+      } else {
+        upgradeToSecureAvailable = false;
+      }
+    });
+  } else {
+    return new Promise(resolve => {
+      upgradeToSecureAvailable = false;
+      resolve();
+    });
+  }
+}
+
+chrome.storage.onChanged.addListener(async function(changes, areaName) {
+  if (areaName === 'sync' || areaName === 'local') {
+    if ('httpNowhere' in changes) {
+      httpNowhereOn = changes.httpNowhere.newValue;
+      updateState();
+    }
+    if ('showCounter' in changes) {
+      showCounter = changes.showCounter.newValue;
+      updateState();
+    }
+    if ('globalEnabled' in changes) {
+      isExtensionEnabled = changes.globalEnabled.newValue;
+      updateState();
+    }
+    if ('enableMixedRulesets' in changes) {
+      // Don't require users to restart the browsers
+      rules.settings.enableMixedRulesets = changes.enableMixedRulesets.newValue;
+      initializeAllRules();
+    }
+    if ('debugging_rulesets' in changes) {
+      initializeAllRules();
+    }
+  }
+});
+
+if (chrome.tabs) {
+  chrome.tabs.onActivated.addListener(function() {
+    updateState();
+  });
+}
+if (chrome.windows) {
+  chrome.windows.onFocusChanged.addListener(function() {
+    updateState();
+  });
+}
+chrome.webNavigation.onCompleted.addListener(function() {
+  updateState();
+});
+
+// Records which tabId's are active in the HTTPS Switch Planner (see
+// pages/devtools/panel-ux.js).
+var switchPlannerEnabledFor = {};
+// Detailed information recorded when the HTTPS Switch Planner is active.
+// Structure is:
+//   switchPlannerInfo[tabId]["rw"/"nrw"][resource_host][active_content][url];
+// rw / nrw stand for "rewritten" versus "not rewritten"
+var switchPlannerInfo = {};
+
+/**
+ * Set the icon color correctly
+ * active: extension is enabled.
+ * blocking: extension is in "block all HTTP requests" mode.
+ * disabled: extension is disabled from the popup menu.
+ */
+
+function updateState () {
+  if (!chrome.tabs) return;
+
+  let iconState = 'active';
+
+  if (!isExtensionEnabled) {
+    iconState = 'disabled';
+  } else if (httpNowhereOn) {
+    iconState = 'blocking';
+  }
+
+  if ('setIcon' in chrome.browserAction) {
+    chrome.browserAction.setIcon({
+      path: {
+        38: 'images/icons/icon-' + iconState + '-38.png'
+      }
+    });
+  }
+
+  chrome.browserAction.setTitle({
+    title: 'HTTPS Everywhere' + ((iconState === 'active') ? '' : ' (' + iconState + ')')
+  });
+
+  chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) {
+    if (!tabs || tabs.length === 0) {
+      return;
+    }
+    const tabId = tabs[0].id;
+    const activeCount = appliedRulesets.getActiveRulesetCount(tabId);
+
+    if ('setBadgeBackgroundColor' in chrome.browserAction) {
+      chrome.browserAction.setBadgeBackgroundColor({ color: '#666666', tabId });
+    }
+
+    const showBadge = activeCount > 0 && isExtensionEnabled && showCounter;
+
+    if ('setBadgeText' in chrome.browserAction) {
+      chrome.browserAction.setBadgeText({ text: showBadge ? String(activeCount) : '', tabId });
+    }
+  });
+}
+
+/**
+ * The following allows fennec to interact with the popup ui
+ * */
+chrome.browserAction.onClicked.addListener(e => {
+  const url = chrome.extension.getURL("/pages/popup/index.html?tabId=" + e.id);
+  chrome.tabs.create({
+    url
+  });
+});
+
+
+
+/**
+ * Add a listener for removed tabs
+ */
+function AppliedRulesets() {
+  this.active_tab_rules = new Map();
+  this.active_tab_main_frames = new Map();
+
+  let that = this;
+  if (chrome.tabs) {
+    chrome.tabs.onRemoved.addListener(function(tabId) {
+      that.removeTab(tabId);
+    });
+  }
+}
+
+AppliedRulesets.prototype = {
+  addRulesetToTab: function(tabId, type, ruleset) {
+    if (!this.active_tab_main_frames.has(tabId)) {
+      this.active_tab_main_frames.set(tabId, false);
+    }
+
+    // always show main_frame ruleset on the top
+    if (type == "main_frame") {
+      this.active_tab_main_frames.set(tabId, true);
+      this.active_tab_rules.set(tabId, [ruleset,]);
+      return ;
+    }
+
+    if (this.active_tab_rules.has(tabId)) {
+      let rulesets = this.active_tab_rules.get(tabId);
+      let insertIndex = 0;
+
+      const ruleset_name = ruleset.name.toLowerCase();
+
+      for (const item of rulesets) {
+        const item_name = item.name.toLowerCase();
+
+        if (item_name == ruleset_name) {
+          return ;
+        } else if (insertIndex == 0 && this.active_tab_main_frames.get(tabId)) {
+          insertIndex = 1;
+        } else if (item_name < ruleset_name) {
+          insertIndex++;
+        }
+      }
+      rulesets.splice(insertIndex, 0, ruleset);
+    } else {
+      this.active_tab_rules.set(tabId, [ruleset,]);
+    }
+  },
+
+  getRulesets: function(tabId) {
+    if (this.active_tab_rules.has(tabId)) {
+      return this.active_tab_rules.get(tabId);
+    } else {
+      return null;
+    }
+  },
+
+  removeTab: function(tabId) {
+    this.active_tab_rules.delete(tabId);
+    this.active_tab_main_frames.delete(tabId);
+  },
+
+  getActiveRulesetCount: function (tabId) {
+    let activeCount = 0;
+
+    const rulesets = this.getRulesets(tabId);
+    if (rulesets) {
+      for (const ruleset of rulesets) {
+        if (ruleset.active) {
+          activeCount++;
+        }
+      }
+    }
+    return activeCount;
+  }
+};
+
+var appliedRulesets = new AppliedRulesets();
+
+var urlBlacklist = new Set();
+
+// redirect counter workaround
+// TODO: Remove this code if they ever give us a real counter
+var redirectCounter = new Map();
+
+const cancelUrl = chrome.extension.getURL("/pages/cancel/index.html");
+
+function redirectOnCancel(shouldCancel){
+  return shouldCancel ? {redirectUrl: cancelUrl} : {cancel: false};
+}
+
+/**
+ * Called before a HTTP(s) request. Does the heavy lifting
+ * Cancels the request/redirects it to HTTPS. URL modification happens in here.
+ * @param details of the handler, see Chrome doc
+ * */
+function onBeforeRequest(details) {
+  // If HTTPSe has been disabled by the user, return immediately.
+  if (!isExtensionEnabled) {
+    return;
+  }
+
+  let uri = new URL(details.url);
+
+  // Normalise hosts with tailing dots, e.g. "www.example.com."
+  while (uri.hostname[uri.hostname.length - 1] === '.' && uri.hostname !== '.') {
+    uri.hostname = uri.hostname.slice(0, -1);
+  }
+
+  // Should the request be canceled?
+  // true if the URL is a http:// connection to a remote canonical host, and not
+  // a tor hidden service
+  const shouldCancel = httpNowhereOn &&
+    (uri.protocol === 'http:' || uri.protocol === 'ftp:') &&
+    uri.hostname.slice(-6) !== '.onion' &&
+    uri.hostname !== 'localhost' &&
+    !/^127(\.[0-9]{1,3}){3}$/.test(uri.hostname) &&
+    uri.hostname !== '0.0.0.0' &&
+    uri.hostname !== '[::1]';
+
+  // If there is a username / password, put them aside during the ruleset
+  // analysis process
+  let using_credentials_in_url = false;
+  let tmp_user;
+  let tmp_pass;
+  if (uri.password || uri.username) {
+    using_credentials_in_url = true;
+    tmp_user = uri.username;
+    tmp_pass = uri.password;
+    uri.username = '';
+    uri.password = '';
+  }
+
+  if (details.url != uri.href && !using_credentials_in_url) {
+    util.log(util.INFO, "Original url " + details.url +
+        " changed before processing to " + uri.href);
+  }
+  if (urlBlacklist.has(uri.href)) {
+    return redirectOnCancel(shouldCancel);
+  }
+
+  if (details.type == "main_frame") {
+    appliedRulesets.removeTab(details.tabId);
+  }
+
+  let potentiallyApplicable = all_rules.potentiallyApplicableRulesets(uri.hostname);
+
+  if (redirectCounter.get(details.requestId) >= 8) {
+    util.log(util.NOTE, "Redirect counter hit for " + uri.href);
+    urlBlacklist.add(uri.href);
+    rules.settings.domainBlacklist.add(uri.hostname);
+    util.log(util.WARN, "Domain blacklisted " + uri.hostname);
+    return redirectOnCancel(shouldCancel);
+  }
+
+  // whether to use mozilla's upgradeToSecure BlockingResponse if available
+  let upgradeToSecure = false;
+  let newuristr = null;
+
+  for (let ruleset of potentiallyApplicable) {
+    appliedRulesets.addRulesetToTab(details.tabId, details.type, ruleset);
+    if (ruleset.active && !newuristr) {
+      newuristr = ruleset.apply(uri.href);
+    }
+  }
+
+  // only use upgradeToSecure for trivial rewrites
+  if (upgradeToSecureAvailable && newuristr) {
+    // check rewritten URIs against the trivially upgraded URI
+    const trivialUpgradeUri = uri.href.replace(/^http:/, "https:");
+    upgradeToSecure = (newuristr == trivialUpgradeUri);
+  }
+
+  // re-insert userpass info which was stripped temporarily
+  if (using_credentials_in_url) {
+    if (newuristr) {
+      const uri_with_credentials = new URL(newuristr);
+      uri_with_credentials.username = tmp_user;
+      uri_with_credentials.password = tmp_pass;
+      newuristr = uri_with_credentials.href;
+    } else {
+      const url_with_credentials = new URL(uri.href);
+      url_with_credentials.username = tmp_user;
+      url_with_credentials.password = tmp_pass;
+      uri.href = url_with_credentials.href;
+    }
+  }
+
+  // In Switch Planner Mode, record any non-rewriteable
+  // HTTP URIs by parent hostname, along with the resource type.
+  if (switchPlannerEnabledFor[details.tabId] && uri.protocol !== "https:") {
+    writeToSwitchPlanner(details.type,
+      details.tabId,
+      uri.hostname,
+      details.url,
+      newuristr);
+  }
+
+  if (httpNowhereOn) {
+    // If loading a main frame, try the HTTPS version as an alternative to
+    // failing.
+    if (shouldCancel) {
+      if (!newuristr) {
+        newuristr = uri.href.replace(/^http:/, "https:");
+        upgradeToSecure = true;
+      } else {
+        newuristr = newuristr.replace(/^http:/, "https:");
+      }
+    }
+    if (
+      newuristr &&
+      (
+        newuristr.substring(0, 5) === "http:" ||
+        newuristr.substring(0, 4) === "ftp:"
+      )
+    ) {
+      // Abort early if we're about to redirect to HTTP or FTP in HTTP Nowhere mode
+      return {redirectUrl: cancelUrl};
+    }
+  }
+
+  if (upgradeToSecureAvailable && upgradeToSecure) {
+    util.log(util.INFO, 'onBeforeRequest returning upgradeToSecure: true');
+    return {upgradeToSecure: true};
+  } else if (newuristr) {
+    util.log(util.INFO, 'onBeforeRequest returning redirectUrl: ' + newuristr);
+    return {redirectUrl: newuristr};
+  } else {
+    util.log(util.INFO, 'onBeforeRequest returning shouldCancel: ' + shouldCancel);
+    return redirectOnCancel(shouldCancel);
+  }
+}
+
+
+// Map of which values for the `type' enum denote active vs passive content.
+// https://developer.chrome.com/extensions/webRequest.html#event-onBeforeRequest
+const mixedContentTypes = {
+  object: 1, other: 1, script: 1, stylesheet: 1, sub_frame: 1, xmlhttprequest: 1,
+  image: 0, main_frame: 0
+};
+
+/**
+ * Record a non-HTTPS URL loaded by a given hostname in the Switch Planner, for
+ * use in determining which resources need to be ported to HTTPS.
+ * (Reminder: Switch planner is the pro-tool enabled by switching into debug-mode)
+ *
+ * @param type: type of the resource (see activeTypes and passiveTypes arrays)
+ * @param tab_id: The id of the tab
+ * @param resource_host: The host of the original url
+ * @param resource_url: the original url
+ * @param rewritten_url: The url rewritten to
+ * */
+function writeToSwitchPlanner(type, tab_id, resource_host, resource_url, rewritten_url) {
+  let rw = rewritten_url ? "rw" : "nrw";
+
+  let active_content = 1;
+  if (mixedContentTypes.hasOwnProperty(type)) {
+    active_content = mixedContentTypes[type];
+  } else {
+    util.log(util.WARN, "Unknown type from onBeforeRequest details: `" + type + "', assuming active");
+  }
+
+  if (!switchPlannerInfo[tab_id]) {
+    switchPlannerInfo[tab_id] = {};
+    switchPlannerInfo[tab_id]["rw"] = {};
+    switchPlannerInfo[tab_id]["nrw"] = {};
+  }
+  if (!switchPlannerInfo[tab_id][rw][resource_host])
+    switchPlannerInfo[tab_id][rw][resource_host] = {};
+  if (!switchPlannerInfo[tab_id][rw][resource_host][active_content])
+    switchPlannerInfo[tab_id][rw][resource_host][active_content] = {};
+
+  switchPlannerInfo[tab_id][rw][resource_host][active_content][resource_url] = 1;
+}
+
+/**
+ * Return the number of properties in an object. For associative maps, this is
+ * their size.
+ * @param obj: object to calc the size for
+ * */
+function objSize(obj) {
+  if (typeof obj == 'undefined') return 0;
+  var size = 0, key;
+  for (key in obj) {
+    if (obj.hasOwnProperty(key)) size++;
+  }
+  return size;
+}
+
+/**
+ * Make an array of asset hosts by score so we can sort them,
+ * presenting the most important ones first.
+ * */
+function sortSwitchPlanner(tab_id, rewritten) {
+  var asset_host_list = [];
+  if (typeof switchPlannerInfo[tab_id] === 'undefined' ||
+      typeof switchPlannerInfo[tab_id][rewritten] === 'undefined') {
+    return [];
+  }
+  var tabInfo = switchPlannerInfo[tab_id][rewritten];
+  for (var asset_host in tabInfo) {
+    var ah = tabInfo[asset_host];
+    var activeCount = objSize(ah[1]);
+    var passiveCount = objSize(ah[0]);
+    var score = activeCount * 100 + passiveCount;
+    asset_host_list.push([score, activeCount, passiveCount, asset_host]);
+  }
+  asset_host_list.sort(function(a,b){return a[0]-b[0];});
+  return asset_host_list;
+}
+
+/**
+ * monitor cookie changes. Automatically convert them to secure cookies
+ * @param changeInfo Cookie changed info, see Chrome doc
+ * */
+function onCookieChanged(changeInfo) {
+  if (!changeInfo.removed && !changeInfo.cookie.secure && isExtensionEnabled) {
+    if (all_rules.shouldSecureCookie(changeInfo.cookie)) {
+      let cookie = {
+        name:changeInfo.cookie.name,
+        value:changeInfo.cookie.value,
+        path:changeInfo.cookie.path,
+        httpOnly:changeInfo.cookie.httpOnly,
+        expirationDate:changeInfo.cookie.expirationDate,
+        storeId:changeInfo.cookie.storeId,
+        secure: true
+      };
+
+      // Host-only cookies don't set the domain field.
+      if (!changeInfo.cookie.hostOnly) {
+        cookie.domain = changeInfo.cookie.domain;
+      }
+
+      // Chromium cookie sameSite status, see https://tools.ietf.org/html/draft-west-first-party-cookies
+      if (changeInfo.cookie.sameSite) {
+        cookie.sameSite = changeInfo.cookie.sameSite;
+      }
+
+      // Firefox first-party isolation
+      if (changeInfo.cookie.firstPartyDomain) {
+        cookie.firstPartyDomain = changeInfo.cookie.firstPartyDomain;
+      }
+
+      // The cookie API is magical -- we must recreate the URL from the domain and path.
+      if (changeInfo.cookie.domain[0] == ".") {
+        cookie.url = "https://www" + changeInfo.cookie.domain + cookie.path;
+      } else {
+        cookie.url = "https://" + changeInfo.cookie.domain + cookie.path;
+      }
+      // We get repeated events for some cookies because sites change their
+      // value repeatedly and remove the "secure" flag.
+      util.log(util.DBUG,
+        "Securing cookie " + cookie.name + " for " + changeInfo.cookie.domain + ", was secure=" + changeInfo.cookie.secure);
+      chrome.cookies.set(cookie);
+    }
+  }
+}
+
+/**
+ * handling redirects, breaking loops
+ * @param details details for the redirect (see chrome doc)
+ * */
+function onBeforeRedirect(details) {
+  // Catch redirect loops (ignoring about:blank, etc. caused by other extensions)
+  let prefix = details.redirectUrl.substring(0, 5);
+  if (prefix === "http:" || prefix === "https") {
+    let count = redirectCounter.get(details.requestId);
+    if (count) {
+      redirectCounter.set(details.requestId, count + 1);
+      util.log(util.DBUG, "Got redirect id "+details.requestId+
+                ": "+count);
+    } else {
+      redirectCounter.set(details.requestId, 1);
+    }
+  }
+}
+
+/**
+ * handle webrequest.onCompleted, cleanup redirectCounter
+ * @param details details for the chrome.webRequest (see chrome doc)
+ */
+function onCompleted(details) {
+  if (redirectCounter.has(details.requestId)) {
+    redirectCounter.delete(details.requestId);
+  }
+}
+
+/**
+ * handle webrequest.onErrorOccurred, cleanup redirectCounter
+ * @param details details for the chrome.webRequest (see chrome doc)
+ */
+function onErrorOccurred(details) {
+  if (redirectCounter.has(details.requestId)) {
+    redirectCounter.delete(details.requestId);
+  }
+}
+
+/**
+ * handle webrequest.onHeadersReceived, insert upgrade-insecure-requests directive and
+ * rewrite access-control-allow-origin if presented in HTTP Nowhere mode
+ * @param details details for the chrome.webRequest (see chrome doc)
+ */
+function onHeadersReceived(details) {
+  if (isExtensionEnabled && httpNowhereOn) {
+    // Do not upgrade the .onion requests in HTTP Nowhere Mode,
+    // See https://github.com/EFForg/https-everywhere/pull/14600#discussion_r168072480
+    const uri = new URL(details.url);
+    if (uri.hostname.slice(-6) == '.onion') {
+      return {};
+    }
+
+    let responseHeadersChanged = false;
+    let cspHeaderFound = false;
+
+    for (const idx in details.responseHeaders) {
+      if (details.responseHeaders[idx].name.match(/Content-Security-Policy/i)) {
+        // Existing CSP headers found
+        cspHeaderFound = true;
+        const value = details.responseHeaders[idx].value;
+
+        // Prepend if no upgrade-insecure-requests directive exists
+        if (!value.match(/upgrade-insecure-requests/i)) {
+          details.responseHeaders[idx].value = "upgrade-insecure-requests; " + value;
+          responseHeadersChanged = true;
+        }
+      }
+
+      if (details.responseHeaders[idx].name.match(/Access-Control-Allow-Origin/i)) {
+        // Existing access-control-allow-origin header found
+        const value = details.responseHeaders[idx].value;
+
+        // If HTTP protocol is used, change it to HTTPS
+        if (value.match(/http:/)) {
+          details.responseHeaders[idx].value = value.replace(/http:/g, "https:");
+          responseHeadersChanged = true;
+        }
+      }
+    }
+
+    if (!cspHeaderFound) {
+      // CSP headers not found
+      const upgradeInsecureRequests = {
+        name: 'Content-Security-Policy',
+        value: 'upgrade-insecure-requests'
+      }
+      details.responseHeaders.push(upgradeInsecureRequests);
+      responseHeadersChanged = true;
+    }
+
+    if (responseHeadersChanged) {
+      return {responseHeaders: details.responseHeaders};
+    }
+  }
+  return {};
+}
+
+// Registers the handler for requests
+// See: https://github.com/EFForg/https-everywhere/issues/10039
+chrome.webRequest.onBeforeRequest.addListener(onBeforeRequest, {urls: ["*://*/*", "ftp://*/*"]}, ["blocking"]);
+
+// Try to catch redirect loops on URLs we've redirected to HTTPS.
+chrome.webRequest.onBeforeRedirect.addListener(onBeforeRedirect, {urls: ["https://*/*"]});
+
+// Cleanup redirectCounter if necessary
+chrome.webRequest.onCompleted.addListener(onCompleted, {urls: ["*://*/*"]});
+
+// Cleanup redirectCounter if necessary
+chrome.webRequest.onErrorOccurred.addListener(onErrorOccurred, {urls: ["*://*/*"]})
+
+// Insert upgrade-insecure-requests directive in httpNowhere mode
+chrome.webRequest.onHeadersReceived.addListener(onHeadersReceived, {urls: ["https://*/*"]}, ["blocking", "responseHeaders"]);
+
+// Listen for cookies set/updated and secure them if applicable. This function is async/nonblocking.
+chrome.cookies.onChanged.addListener(onCookieChanged);
+
+
+/**
+ * disable switch Planner
+ * @param tabId the Tab to disable for
+ */
+function disableSwitchPlannerFor(tabId) {
+  delete switchPlannerEnabledFor[tabId];
+  // Clear stored URL info.
+  delete switchPlannerInfo[tabId];
+}
+
+/**
+ * Enable switch planner for specific tab
+ * @param tabId the tab to enable it for
+ */
+function enableSwitchPlannerFor(tabId) {
+  switchPlannerEnabledFor[tabId] = true;
+}
+
+// Listen for connection from the DevTools panel so we can set up communication.
+chrome.runtime.onConnect.addListener(function (port) {
+  if (port.name == "devtools-page") {
+    chrome.runtime.onMessage.addListener(function(message, sender, sendResponse){
+      var tabId = message.tabId;
+
+      var disableOnCloseCallback = function() {
+        util.log(util.DBUG, "Devtools window for tab " + tabId + " closed, clearing data.");
+        disableSwitchPlannerFor(tabId);
+      };
+
+      const responses = {
+        enable: () => {
+          enableSwitchPlannerFor(tabId);
+          port.onDisconnect.addListener(disableOnCloseCallback);
+        },
+        disable: () => {
+          disableSwitchPlannerFor(tabId);
+        },
+        getHosts: () => {
+          sendResponse({
+            nrw: sortSwitchPlanner(tabId, "nrw"),
+            rw: sortSwitchPlanner(tabId, "rw")
+          });
+          return true;
+        }
+      };
+      if (message.type in responses) {
+        return responses[message.type]();
+      }
+    });
+  }
+});
+
+// This is necessary for communication with the popup in Firefox Private
+// Browsing Mode, see https://bugzilla.mozilla.org/show_bug.cgi?id=1329304
+chrome.runtime.onMessage.addListener(function(message, sender, sendResponse){
+
+  function get_update_channels_generic(update_channels){
+    let last_updated_promises = [];
+    for(let update_channel of update_channels) {
+      last_updated_promises.push(new Promise(resolve => {
+        store.local.get({['rulesets-timestamp: ' + update_channel.name]: 0}, item => {
+          resolve([update_channel.name, item['rulesets-timestamp: ' + update_channel.name]]);
+        });
+      }));
+    }
+    Promise.all(last_updated_promises).then(results => {
+      const last_updated = results.reduce((obj, item) => {
+        obj[item[0]] = item[1];
+        return obj;
+      }, {});
+      sendResponse({update_channels, last_updated});
+    });
+  }
+
+  const responses = {
+    get_option: () => {
+      store.get(message.object, sendResponse);
+      return true;
+    },
+    set_option: () => {
+      store.set(message.object, item => {
+        if (sendResponse) {
+          sendResponse(item);
+        }
+      });
+    },
+    delete_from_ruleset_cache: () => {
+      all_rules.ruleCache.delete(message.object);
+    },
+    get_active_rulesets: () => {
+      sendResponse(appliedRulesets.getRulesets(message.object));
+      return true;
+    },
+    set_ruleset_active_status: () => {
+      let rulesets = appliedRulesets.getRulesets(message.object.tab_id);
+
+      for (let ruleset of rulesets) {
+        if (ruleset.name == message.object.name) {
+          ruleset.active = message.object.active;
+          if (ruleset.default_state == message.object.active) {
+            message.object.active = undefined;
+          }
+          break;
+        }
+      }
+
+      all_rules.setRuleActiveState(message.object.name, message.object.active).then(() => {
+        sendResponse(true);
+      });
+
+      return true;
+    },
+    reset_to_defaults: () => {
+      // restore the 'default states' of the rulesets
+      store.set_promise('ruleActiveStates', {}).then(() => {
+        // clear the caches such that it becomes stateless
+        destroy_caches();
+        // re-activate all rules according to the new states
+        initializeAllRules();
+        // reload tabs when operations completed
+        chrome.tabs.reload();
+      });
+    },
+    add_new_rule: () => {
+      all_rules.addNewRuleAndStore(message.object).then(() => {
+        sendResponse(true);
+      });
+      return true;
+    },
+    remove_rule: () => {
+      all_rules.removeRuleAndStore(message.object);
+    },
+    get_ruleset_timestamps: () => {
+      update.getRulesetTimestamps().then(timestamps => sendResponse(timestamps));
+      return true;
+    },
+    get_pinned_update_channels: () => {
+      get_update_channels_generic(update_channels);
+      return true;
+    },
+    get_stored_update_channels: () => {
+      store.get({update_channels: []}, item => {
+        get_update_channels_generic(item.update_channels);
+      });
+      return true;
+    },
+    create_update_channel: () => {
+
+      store.get({update_channels: []}, item => {
+
+        const update_channel_names = update_channels.concat(item.update_channels).reduce((obj, item) => {
+          obj.add(item.name);
+          return obj;
+        }, new Set());
+
+        if(update_channel_names.has(message.object)){
+          return sendResponse(false);
+        }
+
+        item.update_channels.push({
+          name: message.object,
+          jwk: {},
+          update_path_prefix: ''
+        });
+
+        store.set({update_channels: item.update_channels}, () => {
+          sendResponse(true);
+        });
+
+      });
+      return true;
+    },
+    delete_update_channel: () => {
+      store.get({update_channels: []}, item => {
+        store.set({update_channels: item.update_channels.filter(update_channel => {
+          return (update_channel.name != message.object);
+        })}, () => {
+          store.local.remove([
+            'rulesets-timestamp: ' + message.object,
+            'rulesets-stored-timestamp: ' + message.object,
+            'rulesets: ' + message.object
+          ], () => {
+            initializeAllRules();
+            sendResponse(true);
+          });
+        });
+      });
+      return true;
+    },
+    update_update_channel: () => {
+      store.get({update_channels: []}, item => {
+        for(let i = 0; i < item.update_channels.length; i++){
+          if(item.update_channels[i].name == message.object.name){
+            item.update_channels[i] = message.object;
+          }
+        }
+
+        store.set({update_channels: item.update_channels}, () => {
+          sendResponse(true);
+        });
+
+      });
+      return true;
+    },
+    get_last_checked: () => {
+      store.local.get({'last-checked': false}, item => {
+        sendResponse(item['last-checked']);
+      });
+      return true;
+    }
+  };
+  if (message.type in responses) {
+    return responses[message.type]();
+  }
+});
+
+/**
+ * Clear any cache/ blacklist we have.
+ */
+function destroy_caches() {
+  util.log(util.DBUG, "Destroying caches.");
+  all_rules.cookieHostCache.clear();
+  all_rules.ruleCache.clear();
+  rules.settings.domainBlacklist.clear();
+  urlBlacklist.clear();
+}
+
+Object.assign(exports, {
+  all_rules,
+  urlBlacklist,
+  sortSwitchPlanner,
+  switchPlannerInfo
+});
+
+})(typeof exports == 'undefined' ? require.scopes.background = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/bootstrap.js b/data/extensions/https-everywhere@eff.org/background-scripts/bootstrap.js
new file mode 100644
index 0000000..65d7a7a
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/bootstrap.js
@@ -0,0 +1,9 @@
+"use strict";
+
+function require(module) {
+  if (module.startsWith('./') && require.scopes.hasOwnProperty(module.slice(2))) {
+    return require.scopes[module.slice(2)];
+  }
+  throw new Error('module: ' + module + ' not found.');
+}
+require.scopes = {};
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/incognito.js b/data/extensions/https-everywhere@eff.org/background-scripts/incognito.js
new file mode 100644
index 0000000..ca52177
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/incognito.js
@@ -0,0 +1,73 @@
+"use strict";
+
+(function(exports) {
+
+// This file keeps track of incognito sessions, and clears any caches after
+// an entire incognito session is closed (i.e. all incognito windows are closed).
+
+let state = {
+  incognito_session_exists: false,
+};
+
+function Incognito(onIncognitoDestruction) {
+  Object.assign(this, {onIncognitoDestruction});
+  // Listen to window creation, so we can detect if an incognito window is created
+  if (chrome.windows) {
+    chrome.windows.onCreated.addListener(this.detect_incognito_creation);
+  }
+
+  // Listen to window destruction, so we can clear caches if all incognito windows are destroyed
+  if (chrome.windows) {
+    chrome.windows.onRemoved.addListener(this.detect_incognito_destruction);
+  }
+}
+
+Incognito.prototype = {
+  /**
+   * Detect if an incognito session is created, so we can clear caches when it's destroyed.
+   *
+   * @param window: A standard Window object.
+   */
+  detect_incognito_creation: function(window_) {
+    if (window_.incognito === true) {
+      state.incognito_session_exists = true;
+    }
+  },
+
+  // If a window is destroyed, and an incognito session existed, see if it still does.
+  detect_incognito_destruction: async function() {
+    if (state.incognito_session_exists) {
+      if (!(await any_incognito_windows())) {
+        state.incognito_session_exists = false;
+        this.onIncognitoDestruction();
+      }
+    }
+  },
+}
+
+/**
+ * Check if any incognito window still exists
+ */
+function any_incognito_windows() {
+  return new Promise(resolve => {
+    chrome.windows.getAll(arrayOfWindows => {
+      for (let window_ of arrayOfWindows) {
+        if (window_.incognito === true) {
+          return resolve(true);
+        }
+      }
+      resolve(false);
+    });
+  });
+}
+
+function onIncognitoDestruction(callback) {
+  return new Incognito(callback);
+};
+
+Object.assign(exports, {
+  onIncognitoDestruction,
+  state,
+});
+
+})(typeof exports == 'undefined' ? require.scopes.incognito = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/rules.js b/data/extensions/https-everywhere@eff.org/background-scripts/rules.js
new file mode 100644
index 0000000..e2dac94
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/rules.js
@@ -0,0 +1,690 @@
+"use strict";
+
+(function(exports) {
+
+const util = require('./util');
+
+let settings = {
+  enableMixedRulesets: false,
+  domainBlacklist: new Set(),
+};
+
+// To reduce memory usage for the numerous rules/cookies with trivial rules
+const trivial_cookie_rule_c = /.+/;
+
+// Empty iterable singleton to reduce memory usage
+const nullIterable = Object.create(null, {
+  [Symbol.iterator]: {
+    value: function* () {
+      // do nothing
+    }
+  },
+
+  size: {
+    value: 0
+  },
+});
+
+/**
+ * Constructs a single rule
+ * @param from
+ * @param to
+ * @constructor
+ */
+function Rule(from, to) {
+  this.from_c = new RegExp(from);
+  this.to = to;
+}
+
+// To reduce memory usage for the numerous rules/cookies with trivial rules
+const trivial_rule = new Rule("^http:", "https:");
+
+/**
+ * Returns a common trivial rule or constructs a new one.
+ */
+function getRule(from, to) {
+  if (from === "^http:" && to === "https:") {
+    // This is a trivial rule, rewriting http->https with no complex RegExp.
+    return trivial_rule;
+  } else {
+    // This is a non-trivial rule.
+    return new Rule(from, to);
+  }
+}
+
+/**
+ * Generates a CookieRule
+ * @param host The host regex to compile
+ * @param cookiename The cookie name Regex to compile
+ * @constructor
+ */
+function CookieRule(host, cookiename) {
+  if (host === '.+') {
+    // Some cookie rules trivially match any host.
+    this.host_c = trivial_cookie_rule_c;
+  } else {
+    this.host_c = new RegExp(host);
+  }
+
+  if (cookiename === '.+') {
+    // About 50% of cookie rules trivially match any name.
+    this.name_c = trivial_cookie_rule_c;
+  } else {
+    this.name_c = new RegExp(cookiename);
+  }
+}
+
+/**
+ *A collection of rules
+ * @param set_name The name of this set
+ * @param default_state activity state
+ * @param note Note will be displayed in popup
+ * @constructor
+ */
+function RuleSet(set_name, default_state, note) {
+  this.name = set_name;
+  this.rules = [];
+  this.exclusions = null;
+  this.cookierules = null;
+  this.active = default_state;
+  this.default_state = default_state;
+  this.note = note;
+}
+
+RuleSet.prototype = {
+  /**
+   * Check if a URI can be rewritten and rewrite it
+   * @param urispec The uri to rewrite
+   * @returns {*} null or the rewritten uri
+   */
+  apply: function(urispec) {
+    var returl = null;
+    // If we're covered by an exclusion, go home
+    if (this.exclusions !== null && this.exclusions.test(urispec)) {
+      util.log(util.DBUG, "excluded uri " + urispec);
+      return null;
+    }
+
+    // Okay, now find the first rule that triggers
+    for (let rule of this.rules) {
+      returl = urispec.replace(rule.from_c,
+        rule.to);
+      if (returl != urispec) {
+        return returl;
+      }
+    }
+    return null;
+  },
+
+  /**
+   * Deep equivalence comparison
+   * @param ruleset The ruleset to compare with
+   * @returns true or false, depending on whether it's deeply equivalent
+   */
+  isEquivalentTo: function(ruleset) {
+    if(this.name != ruleset.name ||
+       this.note != ruleset.note ||
+       this.state != ruleset.state ||
+       this.default_state != ruleset.default_state) {
+      return false;
+    }
+
+    try {
+      var this_exclusions_source = this.exclusions.source;
+    } catch(e) {
+      var this_exclusions_source = null;
+    }
+
+    try {
+      var ruleset_exclusions_source = ruleset.exclusions.source;
+    } catch(e) {
+      var ruleset_exclusions_source = null;
+    }
+
+    try {
+      var this_rules_length = this.rules.length;
+    } catch(e) {
+      var this_rules_length = 0;
+    }
+
+    try {
+      var ruleset_rules_length = ruleset.rules.length;
+    } catch(e) {
+      var ruleset_rules_length = 0;
+    }
+
+    if(this_rules_length != ruleset_rules_length) {
+      return false;
+    }
+
+    if (this_exclusions_source != ruleset_exclusions_source) {
+      return false;
+    }
+
+    if(this_rules_length > 0) {
+      for(let x = 0; x < this.rules.length; x++){
+        if(this.rules[x].to != ruleset.rules[x].to) {
+          return false;
+        }
+      }
+    }
+
+    return true;
+  }
+
+};
+
+/**
+ * Initialize Rule Sets
+ * @param ruleActiveStates default state for rules
+ * @constructor
+ */
+function RuleSets() {
+  // Load rules into structure
+  this.targets = new Map();
+
+  // A cache for potentiallyApplicableRulesets
+  this.ruleCache = new Map();
+
+  // A cache for cookie hostnames.
+  this.cookieHostCache = new Map();
+
+  // A hash of rule name -> active status (true/false).
+  this.ruleActiveStates = {};
+
+  // The key to retrieve user rules from the storage api
+  this.USER_RULE_KEY = 'userRules';
+
+  return this;
+}
+
+
+RuleSets.prototype = {
+
+  /**
+   * Load packaged rulesets, and rulesets in browser storage
+   * @param store object from store.js
+   */
+  loadFromBrowserStorage: async function(store, applyStoredFunc) {
+    this.store = store;
+    this.ruleActiveStates = await this.store.get_promise('ruleActiveStates', {});
+    await applyStoredFunc(this);
+    this.loadStoredUserRules();
+    await this.addStoredCustomRulesets();
+  },
+
+  /**
+   * Iterate through data XML and load rulesets
+   */
+  addFromXml: function(ruleXml) {
+    var sets = ruleXml.getElementsByTagName("ruleset");
+    for (let s of sets) {
+      try {
+        this.parseOneXmlRuleset(s);
+      } catch (e) {
+        util.log(util.WARN, 'Error processing ruleset:' + e);
+      }
+    }
+  },
+
+  addFromJson: function(ruleJson) {
+    for (let ruleset of ruleJson) {
+      try {
+        this.parseOneJsonRuleset(ruleset);
+      } catch(e) {
+        util.log(util.WARN, 'Error processing ruleset:' + e);
+      }
+    }
+  },
+
+  parseOneJsonRuleset: function(ruletag) {
+    var default_state = true;
+    var note = "";
+    var default_off = ruletag["default_off"];
+    if (default_off) {
+      default_state = false;
+      note += default_off + "\n";
+    }
+
+    // If a ruleset declares a platform, and we don't match it, treat it as
+    // off-by-default. In practice, this excludes "mixedcontent" rules.
+    var platform = ruletag["platform"]
+    if (platform) {
+      default_state = false;
+      if (platform == "mixedcontent" && settings.enableMixedRulesets) {
+        default_state = true;
+      }
+      note += "Platform(s): " + platform + "\n";
+    }
+
+    var rule_set = new RuleSet(ruletag["name"], default_state, note.trim());
+
+    // Read user prefs
+    if (rule_set.name in this.ruleActiveStates) {
+      rule_set.active = this.ruleActiveStates[rule_set.name];
+    }
+
+    var rules = ruletag["rule"];
+    for (let rule of rules) {
+      if (rule["from"] != null && rule["to"] != null) {
+        rule_set.rules.push(getRule(rule["from"], rule["to"]));
+      }
+    }
+
+    var exclusions = ruletag["exclusion"];
+    if (exclusions != null) {
+      rule_set.exclusions = new RegExp(exclusions.join("|"));
+    }
+
+    var cookierules = ruletag["securecookie"];
+    if (cookierules != null) {
+      for (let cookierule of cookierules) {
+        if (cookierule["host"] != null && cookierule["name"] != null) {
+          if (!rule_set.cookierules) {
+            rule_set.cookierules = [];
+          }
+          rule_set.cookierules.push(new CookieRule(cookierule["host"], cookierule["name"]));
+        }
+      }
+    }
+
+    var targets = ruletag["target"];
+    for (let target of targets) {
+      if (target != null) {
+        if (!this.targets.has(target)) {
+          this.targets.set(target, []);
+        }
+        this.targets.get(target).push(rule_set);
+      }
+    }
+  },
+
+  /**
+   * Load a user rule
+   * @param params
+   * @returns {boolean}
+   */
+  addUserRule : function(params) {
+    util.log(util.INFO, 'adding new user rule for ' + JSON.stringify(params));
+    var new_rule_set = new RuleSet(params.host, true, "user rule");
+    var new_rule = getRule(params.urlMatcher, params.redirectTo);
+    new_rule_set.rules.push(new_rule);
+    if (!this.targets.has(params.host)) {
+      this.targets.set(params.host, []);
+    }
+    this.ruleCache.delete(params.host);
+    // TODO: maybe promote this rule?
+    this.targets.get(params.host).push(new_rule_set);
+    if (new_rule_set.name in this.ruleActiveStates) {
+      new_rule_set.active = this.ruleActiveStates[new_rule_set.name];
+    }
+    util.log(util.INFO, 'done adding rule');
+    return true;
+  },
+
+  /**
+   * Remove a user rule
+   * @param params
+   * @returns {boolean}
+   */
+  removeUserRule: function(ruleset) {
+    util.log(util.INFO, 'removing user rule for ' + JSON.stringify(ruleset));
+    this.ruleCache.delete(ruleset.name);
+
+
+    var tmp = this.targets.get(ruleset.name).filter(r =>
+      !(r.isEquivalentTo(ruleset))
+    );
+    this.targets.set(ruleset.name, tmp);
+
+    if (this.targets.get(ruleset.name).length == 0) {
+      this.targets.delete(ruleset.name);
+    }
+
+    util.log(util.INFO, 'done removing rule');
+    return true;
+  },
+
+  /**
+  * Retrieve stored user rules from storage api
+  **/
+  getStoredUserRules: async function() {
+    return await this.store.get_promise(this.USER_RULE_KEY, []);
+  },
+
+  /**
+  * Load all stored user rules into this RuleSet object
+  */
+  loadStoredUserRules: async function() {
+    const user_rules = await this.getStoredUserRules();
+    for (let user_rule of user_rules) {
+      this.addUserRule(user_rule);
+    }
+    util.log(util.INFO, 'loaded ' + user_rules.length + ' stored user rules');
+  },
+
+  /**
+  * Adds a new user rule
+  * @param params: params defining the rule
+  * @param cb: Callback to call after success/fail
+  * */
+  addNewRuleAndStore: async function(params) {
+    if (this.addUserRule(params)) {
+      // If we successfully added the user rule, save it in the storage
+      // api so it's automatically applied when the extension is
+      // reloaded.
+      let userRules = await this.getStoredUserRules();
+      // TODO: there's a race condition here, if this code is ever executed from multiple
+      // client windows in different event loops.
+      userRules.push(params);
+      // TODO: can we exceed the max size for storage?
+      await this.store.set_promise(this.USER_RULE_KEY, userRules);
+    }
+  },
+
+  /**
+  * Removes a user rule
+  * @param ruleset: the ruleset to remove
+  * */
+  removeRuleAndStore: async function(ruleset) {
+    if (this.removeUserRule(ruleset)) {
+      // If we successfully removed the user rule, remove it in local storage too
+      let userRules = await this.getStoredUserRules();
+      userRules = userRules.filter(r =>
+        !(r.host == ruleset.name &&
+          r.redirectTo == ruleset.rules[0].to)
+      );
+      await this.store.set_promise(this.USER_RULE_KEY, userRules);
+    }
+  },
+
+  addStoredCustomRulesets: function(){
+    return new Promise(resolve => {
+      this.store.get({
+        legacy_custom_rulesets: [],
+        debugging_rulesets: ""
+      }, item => {
+        this.loadCustomRulesets(item.legacy_custom_rulesets);
+        this.loadCustomRuleset("<root>" + item.debugging_rulesets + "</root>");
+        resolve();
+      });
+    });
+  },
+
+  // Load in the legacy custom rulesets, if any
+  loadCustomRulesets: function(legacy_custom_rulesets){
+    for(let legacy_custom_ruleset of legacy_custom_rulesets){
+      this.loadCustomRuleset(legacy_custom_ruleset);
+    }
+  },
+
+  loadCustomRuleset: function(ruleset_string){
+    this.addFromXml((new DOMParser()).parseFromString(ruleset_string, 'text/xml'));
+  },
+
+  setRuleActiveState: async function(ruleset_name, active){
+    if (active == undefined) {
+      delete this.ruleActiveStates[ruleset_name];
+    } else {
+      this.ruleActiveStates[ruleset_name] = active;
+    }
+    await this.store.set_promise('ruleActiveStates', this.ruleActiveStates);
+  },
+
+  /**
+   * Does the loading of a ruleset.
+   * @param ruletag The whole <ruleset> tag to parse
+   */
+  parseOneXmlRuleset: function(ruletag) {
+    var default_state = true;
+    var note = "";
+    var default_off = ruletag.getAttribute("default_off");
+    if (default_off) {
+      default_state = false;
+      note += default_off + "\n";
+    }
+
+    // If a ruleset declares a platform, and we don't match it, treat it as
+    // off-by-default. In practice, this excludes "mixedcontent" rules.
+    var platform = ruletag.getAttribute("platform");
+    if (platform) {
+      default_state = false;
+      if (platform == "mixedcontent" && settings.enableMixedRulesets) {
+        default_state = true;
+      }
+      note += "Platform(s): " + platform + "\n";
+    }
+
+    var rule_set = new RuleSet(ruletag.getAttribute("name"),
+      default_state,
+      note.trim());
+
+    // Read user prefs
+    if (rule_set.name in this.ruleActiveStates) {
+      rule_set.active = (this.ruleActiveStates[rule_set.name] == "true");
+    }
+
+    var rules = ruletag.getElementsByTagName("rule");
+    for (let rule of rules) {
+      rule_set.rules.push(getRule(rule.getAttribute("from"),
+        rule.getAttribute("to")));
+    }
+
+    var exclusions = Array();
+    for (let exclusion of ruletag.getElementsByTagName("exclusion")) {
+      exclusions.push(exclusion.getAttribute("pattern"));
+    }
+    if (exclusions.length > 0) {
+      rule_set.exclusions = new RegExp(exclusions.join("|"));
+    }
+
+    var cookierules = ruletag.getElementsByTagName("securecookie");
+    if (cookierules.length > 0) {
+      rule_set.cookierules = [];
+      for (let cookierule of cookierules) {
+        rule_set.cookierules.push(
+          new CookieRule(cookierule.getAttribute("host"),
+            cookierule.getAttribute("name")));
+      }
+    }
+
+    var targets = ruletag.getElementsByTagName("target");
+    for (let target of targets) {
+      var host = target.getAttribute("host");
+      if (!this.targets.has(host)) {
+        this.targets.set(host, []);
+      }
+      this.targets.get(host).push(rule_set);
+    }
+  },
+
+  /**
+   * Return a list of rulesets that apply to this host
+   * @param host The host to check
+   * @returns {*} (empty) list
+   */
+  potentiallyApplicableRulesets: function(host) {
+    // Have we cached this result? If so, return it!
+    if (this.ruleCache.has(host)) {
+      let cached_item = this.ruleCache.get(host);
+      util.log(util.DBUG, "Ruleset cache hit for " + host + " items:" + cached_item.size);
+      return cached_item;
+    } else {
+      util.log(util.DBUG, "Ruleset cache miss for " + host);
+    }
+
+    // Let's begin search
+    // Copy the host targets so we don't modify them.
+    let results = (this.targets.has(host) ?
+      new Set([...this.targets.get(host)]) :
+      new Set());
+
+    // Ensure host is well-formed (RFC 1035)
+    if (host.length <= 0 || host.length > 255 || host.indexOf("..") != -1) {
+      util.log(util.WARN, "Malformed host passed to potentiallyApplicableRulesets: " + host);
+      return nullIterable;
+    }
+
+    // Replace each portion of the domain with a * in turn
+    let segmented = host.split(".");
+    for (let i = 0; i < segmented.length; i++) {
+      let tmp = segmented[i];
+      segmented[i] = "*";
+
+      results = (this.targets.has(segmented.join(".")) ?
+        new Set([...results, ...this.targets.get(segmented.join("."))]) :
+        results);
+
+      segmented[i] = tmp;
+    }
+
+    // now eat away from the left, with *, so that for x.y.z.google.com we
+    // check *.z.google.com and *.google.com (we did *.y.z.google.com above)
+    for (let i = 2; i <= segmented.length - 2; i++) {
+      let t = "*." + segmented.slice(i, segmented.length).join(".");
+
+      results = (this.targets.has(t) ?
+        new Set([...results, ...this.targets.get(t)]) :
+        results);
+    }
+
+    // Clean the results list, which may contain duplicates or undefined entries
+    results.delete(undefined);
+
+    util.log(util.DBUG,"Applicable rules for " + host + ":");
+    if (results.size == 0) {
+      util.log(util.DBUG, "  None");
+      results = nullIterable;
+    } else {
+      results.forEach(result => util.log(util.DBUG, "  " + result.name));
+    }
+
+    // Insert results into the ruleset cache
+    this.ruleCache.set(host, results);
+
+    // Cap the size of the cache. (Limit chosen somewhat arbitrarily)
+    if (this.ruleCache.size > 1000) {
+      // Map.prototype.keys() returns keys in insertion order, so this is a FIFO.
+      this.ruleCache.delete(this.ruleCache.keys().next().value);
+    }
+
+    return results;
+  },
+
+  /**
+   * Check to see if the Cookie object c meets any of our cookierule criteria for being marked as secure.
+   * @param cookie The cookie to test
+   * @returns {*} ruleset or null
+   */
+  shouldSecureCookie: function(cookie) {
+    var hostname = cookie.domain;
+    // cookie domain scopes can start with .
+    while (hostname.charAt(0) == ".") {
+      hostname = hostname.slice(1);
+    }
+
+    if (!this.safeToSecureCookie(hostname)) {
+      return null;
+    }
+
+    var potentiallyApplicable = this.potentiallyApplicableRulesets(hostname);
+    for (let ruleset of potentiallyApplicable) {
+      if (ruleset.cookierules !== null && ruleset.active) {
+        for (let cookierules of ruleset.cookierules) {
+          var cr = cookierules;
+          if (cr.host_c.test(cookie.domain) && cr.name_c.test(cookie.name)) {
+            return ruleset;
+          }
+        }
+      }
+    }
+    return null;
+  },
+
+  /**
+   * Check if it is secure to secure the cookie (=patch the secure flag in).
+   * @param domain The domain of the cookie
+   * @returns {*} true or false
+   */
+  safeToSecureCookie: function(domain) {
+    // Check if the domain might be being served over HTTP.  If so, it isn't
+    // safe to secure a cookie!  We can't always know this for sure because
+    // observing cookie-changed doesn't give us enough context to know the
+    // full origin URI.
+
+    // First, if there are any redirect loops on this domain, don't secure
+    // cookies.  XXX This is not a very satisfactory heuristic.  Sometimes we
+    // would want to secure the cookie anyway, because the URLs that loop are
+    // not authenticated or not important.  Also by the time the loop has been
+    // observed and the domain blacklisted, a cookie might already have been
+    // flagged as secure.
+
+    if (settings.domainBlacklist.has(domain)) {
+      util.log(util.INFO, "cookies for " + domain + "blacklisted");
+      return false;
+    }
+    var cached_item = this.cookieHostCache.get(domain);
+    if (cached_item !== undefined) {
+      util.log(util.DBUG, "Cookie host cache hit for " + domain);
+      return cached_item;
+    }
+    util.log(util.DBUG, "Cookie host cache miss for " + domain);
+
+    // If we passed that test, make up a random URL on the domain, and see if
+    // we would HTTPSify that.
+
+    var nonce_path = "/" + Math.random().toString();
+    var test_uri = "http://" + domain + nonce_path + nonce_path;
+
+    // Cap the size of the cookie cache (limit chosen somewhat arbitrarily)
+    if (this.cookieHostCache.size > 250) {
+      // Map.prototype.keys() returns keys in insertion order, so this is a FIFO.
+      this.cookieHostCache.delete(this.cookieHostCache.keys().next().value);
+    }
+
+    util.log(util.INFO, "Testing securecookie applicability with " + test_uri);
+    var potentiallyApplicable = this.potentiallyApplicableRulesets(domain);
+    for (let ruleset of potentiallyApplicable) {
+      if (!ruleset.active) {
+        continue;
+      }
+      if (ruleset.apply(test_uri)) {
+        util.log(util.INFO, "Cookie domain could be secured.");
+        this.cookieHostCache.set(domain, true);
+        return true;
+      }
+    }
+    util.log(util.INFO, "Cookie domain could NOT be secured.");
+    this.cookieHostCache.set(domain, false);
+    return false;
+  },
+
+  /**
+   * Rewrite an URI
+   * @param urispec The uri to rewrite
+   * @param host The host of this uri
+   * @returns {*} the new uri or null
+   */
+  rewriteURI: function(urispec, host) {
+    var newuri = null;
+    var potentiallyApplicable = this.potentiallyApplicableRulesets(host);
+    for (let ruleset of potentiallyApplicable) {
+      if (ruleset.active && (newuri = ruleset.apply(urispec))) {
+        return newuri;
+      }
+    }
+    return null;
+  }
+};
+
+Object.assign(exports, {
+  nullIterable,
+  settings,
+  trivial_rule,
+  Rule,
+  RuleSet,
+  RuleSets,
+  getRule
+});
+
+})(typeof exports == 'undefined' ? require.scopes.rules = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/store.js b/data/extensions/https-everywhere@eff.org/background-scripts/store.js
new file mode 100644
index 0000000..3b555c7
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/store.js
@@ -0,0 +1,103 @@
+"use strict";
+
+(function(exports) {
+
+const rules = require('./rules');
+
+function initialize() {
+  return new Promise(resolve => {
+    if (chrome.storage.sync) {
+      chrome.storage.sync.set({"sync-set-test": true}, () => {
+        if(chrome.runtime.lastError){
+          setStorage(chrome.storage.local);
+        } else {
+          setStorage(chrome.storage.sync);
+        }
+        resolve();
+      });
+    } else {
+      setStorage(chrome.storage.local);
+      resolve();
+    }
+  });
+}
+
+/* Storage promise setters and getters */
+
+function generic_get_promise(key, default_val, storage) {
+  return new Promise(res => storage.get({[key]: default_val}, data => res(data[key])));
+}
+
+function generic_set_promise(key, value, storage) {
+  return new Promise(res => storage.set({[key]: value}, res));
+}
+
+function get_promise(key, default_val) {
+  return generic_get_promise(key, default_val, exports);
+}
+
+function set_promise(key, value) {
+  return generic_set_promise(key, value, exports);
+}
+
+function local_get_promise(key, default_val) {
+  return generic_get_promise(key, default_val, chrome.storage.local);
+}
+
+function local_set_promise(key, value) {
+  return generic_set_promise(key, value, chrome.storage.local);
+}
+
+
+
+async function performMigrations() {
+  const migration_version = await get_promise('migration_version', 0);
+
+  if (migration_version < 1) {
+
+    let ls;
+    try {
+      ls = localStorage;
+    } catch(e) {}
+
+    let ruleActiveStates = {};
+    for (const key in ls) {
+      if (ls.hasOwnProperty(key)) {
+        if (key == rules.RuleSets().USER_RULE_KEY){
+          await set_promise(rules.RuleSets().USER_RULE_KEY, JSON.parse(ls[key]));
+        } else {
+          ruleActiveStates[key] = (ls[key] == "true");
+        }
+      }
+    }
+    await set_promise('ruleActiveStates', ruleActiveStates);
+  }
+
+  await set_promise('migration_version', 1);
+}
+
+const local = {
+  get: chrome.storage.local.get,
+  set: chrome.storage.local.set,
+  remove: chrome.storage.local.remove,
+  get_promise: local_get_promise,
+  set_promise: local_set_promise
+};
+
+function setStorage(store) {
+  Object.assign(exports, {
+    get: store.get.bind(store),
+    set: store.set.bind(store),
+    remove: store.remove.bind(store),
+    get_promise,
+    set_promise,
+    local
+  });
+}
+
+Object.assign(exports, {
+  initialize,
+  performMigrations
+});
+
+})(typeof exports == 'undefined' ? require.scopes.store = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/update.js b/data/extensions/https-everywhere@eff.org/background-scripts/update.js
new file mode 100644
index 0000000..795f968
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/update.js
@@ -0,0 +1,280 @@
+/* global pako */
+
+"use strict";
+
+let combined_update_channels;
+const { update_channels } = require('./update_channels');
+
+// Determine if we're in the tests.  If so, define some necessary components.
+if (typeof window === "undefined") {
+  var WebCrypto = require("node-webcrypto-ossl"),
+    crypto = new WebCrypto(),
+    atob = require("atob"),
+    btoa = require("btoa"),
+    pako = require('../external/pako-1.0.5/pako_inflate.min.js'),
+    { TextDecoder } = require('text-encoding'),
+    chrome = require("sinon-chrome"),
+    window = { atob, btoa, chrome, crypto, pako, TextDecoder };
+
+  combined_update_channels = update_channels;
+}
+
+(function(exports) {
+
+const util = require('./util');
+
+let store,
+  background_callback;
+
+// how often we should check for new rulesets
+const periodicity = 86400;
+
+let imported_keys;
+
+// update channels are loaded from `background-scripts/update_channels.js` as well as the storage api
+async function loadUpdateChannelsKeys() {
+  util.log(util.NOTE, 'Loading update channels and importing associated public keys.');
+
+  const stored_update_channels = await store.get_promise('update_channels', []);
+  const combined_update_channels_preflight = update_channels.concat(stored_update_channels);
+
+  imported_keys = {};
+  combined_update_channels = [];
+
+  for(let update_channel of combined_update_channels_preflight){
+
+    try{
+      imported_keys[update_channel.name] = await window.crypto.subtle.importKey(
+        "jwk",
+        update_channel.jwk,
+        {
+          name: "RSA-PSS",
+          hash: {name: "SHA-256"},
+        },
+        false,
+        ["verify"]
+      );
+      combined_update_channels.push(update_channel);
+    } catch(err) {
+      util.log(util.WARN, update_channel.name + ': Could not import key.  Aborting.');
+    }
+  }
+}
+
+
+// Determine the time until we should check for new rulesets
+async function timeToNextCheck() {
+  const last_checked = await store.local.get_promise('last-checked', false);
+  if(last_checked) {
+    const current_timestamp = Date.now() / 1000;
+    const secs_since_last_checked = current_timestamp - last_checked;
+    return Math.max(0, periodicity - secs_since_last_checked);
+  } else {
+    return 0;
+  }
+}
+
+// Check for new rulesets. If found, return the timestamp. If not, return false
+async function checkForNewRulesets(update_channel) {
+  let timestamp_result = await fetch(update_channel.update_path_prefix + "/latest-rulesets-timestamp");
+  if(timestamp_result.status == 200) {
+    let rulesets_timestamp = Number(await timestamp_result.text());
+
+    if((await store.local.get_promise('rulesets-timestamp: ' + update_channel.name, 0)) < rulesets_timestamp){
+      return rulesets_timestamp;
+    }
+  }
+  return false;
+}
+
+// Retrieve the timestamp for when a stored ruleset bundle was published
+async function getRulesetTimestamps(){
+  let timestamp_promises = [];
+  for(let update_channel of combined_update_channels){
+    timestamp_promises.push(new Promise(async resolve => {
+      let timestamp = await store.local.get_promise('rulesets-stored-timestamp: ' + update_channel.name, 0);
+      resolve([update_channel.name, timestamp]);
+    }));
+  }
+  let timestamps = await Promise.all(timestamp_promises);
+  return timestamps;
+}
+
+// Download and return new rulesets
+async function getNewRulesets(rulesets_timestamp, update_channel) {
+
+  store.local.set_promise('rulesets-timestamp: ' + update_channel.name, rulesets_timestamp);
+
+  let signature_promise = fetch(update_channel.update_path_prefix + "/rulesets-signature." + rulesets_timestamp + ".sha256");
+  let rulesets_promise = fetch(update_channel.update_path_prefix + "/default.rulesets." + rulesets_timestamp + ".gz");
+
+  let responses = await Promise.all([
+    signature_promise,
+    rulesets_promise
+  ]);
+
+  let resolutions = await Promise.all([
+    responses[0].arrayBuffer(),
+    responses[1].arrayBuffer()
+  ]);
+
+  return {
+    signature_array_buffer: resolutions[0],
+    rulesets_array_buffer: resolutions[1]
+  };
+}
+
+// Returns a promise which verifies that the rulesets have a valid EFF
+// signature, and if so, stores them and returns true.
+// Otherwise, it throws an exception.
+function verifyAndStoreNewRulesets(new_rulesets, rulesets_timestamp, update_channel){
+  return new Promise((resolve, reject) => {
+    window.crypto.subtle.verify(
+      {
+        name: "RSA-PSS",
+        saltLength: 32
+      },
+      imported_keys[update_channel.name],
+      new_rulesets.signature_array_buffer,
+      new_rulesets.rulesets_array_buffer
+    ).then(async isvalid => {
+      if(isvalid) {
+        util.log(util.NOTE, update_channel.name + ': Downloaded ruleset signature checks out.  Storing rulesets.');
+
+        const rulesets_gz = util.ArrayBufferToString(new_rulesets.rulesets_array_buffer);
+        const rulesets_byte_array = pako.inflate(rulesets_gz);
+        const rulesets = new TextDecoder("utf-8").decode(rulesets_byte_array);
+        const rulesets_json = JSON.parse(rulesets);
+
+        if(rulesets_json.timestamp != rulesets_timestamp){
+          reject(update_channel.name + ': Downloaded ruleset had an incorrect timestamp.  This may be an attempted downgrade attack.  Aborting.');
+        } else {
+          await store.local.set_promise('rulesets: ' + update_channel.name, window.btoa(rulesets_gz));
+          resolve(true);
+        }
+      } else {
+        reject(update_channel.name + ': Downloaded ruleset signature is invalid.  Aborting.');
+      }
+    }).catch(() => {
+      reject(update_channel.name + ': Downloaded ruleset signature could not be verified.  Aborting.');
+    });
+  });
+}
+
+// Unzip and apply the rulesets we have stored.
+async function applyStoredRulesets(rulesets_obj){
+  let rulesets_promises = [];
+  for(let update_channel of combined_update_channels){
+    rulesets_promises.push(new Promise(resolve => {
+      const key = 'rulesets: ' + update_channel.name;
+      chrome.storage.local.get(key, root => {
+        if(root[key]){
+          util.log(util.NOTE, update_channel.name + ': Applying stored rulesets.');
+
+          const rulesets_gz = window.atob(root[key]);
+          const rulesets_byte_array = pako.inflate(rulesets_gz);
+          const rulesets = new TextDecoder("utf-8").decode(rulesets_byte_array);
+          const rulesets_json = JSON.parse(rulesets);
+
+          resolve(rulesets_json);
+        } else {
+          resolve();
+        }
+      });
+    }));
+  }
+
+  const rulesets_jsons = await Promise.all(rulesets_promises);
+  if(rulesets_jsons.join("").length > 0){
+    for(let rulesets_json of rulesets_jsons){
+      if(typeof(rulesets_json) != 'undefined'){
+        rulesets_obj.addFromJson(rulesets_json.rulesets);
+      }
+    }
+  } else {
+    rulesets_obj.addFromJson(util.loadExtensionFile('rules/default.rulesets', 'json'));
+  }
+}
+
+// basic workflow for periodic checks
+async function performCheck() {
+  util.log(util.NOTE, 'Checking for new rulesets.');
+
+  const current_timestamp = Date.now() / 1000;
+  store.local.set_promise('last-checked', current_timestamp);
+
+  let num_updates = 0;
+  for(let update_channel of combined_update_channels){
+    let new_rulesets_timestamp = await checkForNewRulesets(update_channel);
+    if(new_rulesets_timestamp){
+      util.log(util.NOTE, update_channel.name + ': A new ruleset bundle has been released.  Downloading now.');
+      let new_rulesets = await getNewRulesets(new_rulesets_timestamp, update_channel);
+      try{
+        await verifyAndStoreNewRulesets(new_rulesets, new_rulesets_timestamp, update_channel);
+        store.local.set_promise('rulesets-stored-timestamp: ' + update_channel.name, new_rulesets_timestamp);
+        num_updates++;
+      } catch(err) {
+        util.log(util.WARN, update_channel.name + ': ' + err);
+      }
+    }
+  }
+  if(num_updates > 0){
+    background_callback();
+  }
+};
+
+chrome.storage.onChanged.addListener(async function(changes, areaName) {
+  if (areaName === 'sync' || areaName === 'local') {
+    if ('autoUpdateRulesets' in changes) {
+      if (changes.autoUpdateRulesets.newValue) {
+        await createTimer();
+      } else {
+        destroyTimer();
+      }
+    }
+  }
+
+  if ('update_channels' in changes) {
+    await loadUpdateChannelsKeys();
+  }
+});
+
+let initialCheck,
+  subsequentChecks;
+
+async function createTimer(){
+  const time_to_next_check = await timeToNextCheck();
+
+  initialCheck = setTimeout(() => {
+    performCheck();
+    subsequentChecks = setInterval(performCheck, periodicity * 1000);
+  }, time_to_next_check * 1000);
+}
+
+function destroyTimer(){
+  if (initialCheck) {
+    clearTimeout(initialCheck);
+  }
+  if (subsequentChecks) {
+    clearInterval(subsequentChecks);
+  }
+}
+
+async function initialize(store_param, cb){
+  store = store_param;
+  background_callback = cb;
+
+  await loadUpdateChannelsKeys();
+
+  if (await store.get_promise('autoUpdateRulesets', false)) {
+    await createTimer();
+  }
+}
+
+Object.assign(exports, {
+  applyStoredRulesets,
+  initialize,
+  getRulesetTimestamps
+});
+
+})(typeof exports == 'undefined' ? require.scopes.update = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/update_channels.js b/data/extensions/https-everywhere@eff.org/background-scripts/update_channels.js
new file mode 100644
index 0000000..8bb21c9
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/update_channels.js
@@ -0,0 +1,23 @@
+/* exported update_channels */
+
+'use strict';
+
+(function (exports) {
+
+exports.update_channels = [{
+  name: 'EFF (Full)',
+  jwk: {
+    kty: 'RSA',
+    e: 'AQAB',
+    n: '1cwvFQu3Kw-Pz8bcEFuV5zx0ZheDsc4Tva7Qv6BL90_sDLqCW79Y543nDkPtNVfFH_89pt2kSPp_IcS5XnYiw6zBQeFuILFw5JpvZt14K0s4' +
+       'e025Q9CXfhYKIBKT9PnqihwAacjMa6rQb7RTu7XxVvqxRb3b0vx2CR40LSlYZ8H_KpeaUwq2oz-fyrI6LFTeYvbO3ZuLKeK5xV1a32xeTVMF' +
+       'kIj3LxnQalxq-DRHfj7LRRoTnbRDW4uoDc8aVpLFliuO79jUKbobz4slpiWJ4wjKR_O6OK13HbZUiOSxi8Bms-UqBPOyzbMVpmA7lv_zWdaL' +
+       'u1IVlVXQyLVbbrqI6llRqfHdcJoEl-eC48AofuB-relQtjTEK_hyBf7sPwrbqAarjRjlyEx6Qy5gTXyxM9attfNAeupYR6jm8LKm6TFpfWky' +
+       'DxUmj_f5pJMBWNTomV74f8iQ2M18_KWMUDCOf80tR0t21Q1iCWdvA3K_KJn05tTLyumlwwlQijMqRkYuao-CX9L3DJIaB3VPYPTSIPUr7oi1' +
+       '6agsuamOyiOtlZiRpEvoNg2ksJMZtwnj5xhBQydkdhMW2ZpHDzcLuZlhJYZL_l3_7wuzRM7vpyA9obP92CpZRFJErGZmFxJC93I4U9-0B0wg' +
+       '-sbyMKGJ5j1BWTnibCklDXtWzXtuiz18EgE'
+  },
+  update_path_prefix: 'https://www.https-rulesets.org/v1/'
+}];
+
+})(typeof exports === 'undefined' ? require.scopes.update_channels = {} : exports);
diff --git a/data/extensions/https-everywhere@eff.org/background-scripts/util.js b/data/extensions/https-everywhere@eff.org/background-scripts/util.js
new file mode 100644
index 0000000..06c87ad
--- /dev/null
+++ b/data/extensions/https-everywhere@eff.org/background-scripts/util.js
@@ -0,0 +1,93 @@
+"use strict";
+
+(function(exports) {
+
+var VERB = 1;
+var DBUG = 2;
+var INFO = 3;
+var NOTE = 4;
+var WARN = 5;
+// FYI: Logging everything is /very/ slow. Chrome will log & buffer
+// these console logs even when the debug tools are closed. :(
+
+// TODO: Add an easy UI to change the log level.
+// (Developers can just type DEFAULT_LOG_LEVEL=VERB in the console)
+var DEFAULT_LOG_LEVEL = NOTE;
+console.log("Hey developer! Want to see more verbose logging?");
+console.log("Type this into the console: let util = require('./util'); util.setDefaultLogLevel(util.VERB);");
+console.log("Accepted levels are VERB, DBUG, INFO, NOTE and WARN, default is NOTE");
+
+function log(level, str) {
+  if (level >= DEFAULT_LOG_LEVEL) {
+    if (level === WARN) {
+      // Show warning with a little yellow icon in Chrome.
+      console.warn(str);
+    } else {
+      console.log(str);
+    }
+  }
+}
+
+function setDefaultLogLevel(level) {
+  DEFAULT_LOG_LEVEL = level;
+}
+
+function getDefaultLogLevel() {
+  return DEFAULT_LOG_LEVEL;
+}
+
+/**
+ * Load a file packaged with the extension
+ *
+ * @param url: a relative URL to local file
+ */
+function loadExtensionFile(url, returnType) {
+  var xhr = new XMLHttpRequest();
+  // Use blocking XHR to ensure everything is loaded by the time
+  // we return.
+  xhr.open("GET", chrome.extension.getURL(url), false);
+  xhr.send(null);
+  // Get file contents
+  if (xhr.readyState !== 4) {
+    return;
+  }
+  if (returnType === 'xml') {
+    return xhr.responseXML;
+  }
+  if (returnType === 'json') {
+    return JSON.parse(xhr.responseText);
+  }
+  return xhr.responseText;
+}
+
+/**
+ * Convert an ArrayBuffer to string
+ *
+ * @param array: an ArrayBuffer to convert
+ */
+function ArrayBufferToString(ab) {
+  let array = new Uint8Array(ab);
+  let string = "";
+
+  for (let byte of array){
+    string += String.fromCharCode(byte);
+  }
+
+  return string;
+}
+
+
+Object.assign(exports, {
+  VERB,
+  DBUG,
+  INFO,
+  NOTE,
+  WARN,
+  log,
+  setDefaultLogLevel,
+  getDefaultLogLevel,
+  loadExtensionFile,
+  ArrayBufferToString
+});
+
+})(typeof exports == 'undefined' ? require.scopes.util = {} : exports);