Bugzilla

I think it could be patched by implementing in the URI check for [fragment navigations](https://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#8766-8770) a URI modifier like: https://searchfox.org/mozilla-central/source/dom/security/nsHTTPSOnlyUtils.cpp#751,779-795. 

Something that looks like: 
```C++
              // If we entered here the current scheme is https (upgraded by
              // HTTPS-Only/-First mode) and the navigation is a fragment
              // navigation. For that reason we should navigate from https to
              // https.
              NS_ENSURE_SUCCESS(rv, false);
              nsCOMPtr<nsIURI> newHTTPSFragNavURI;
              // Port should be set to the port value of the source (URI's port  that we are navigating from)
              rv = NS_MutateURI(oldHTTPFragNavURI)
                       .SetScheme("https"_ns)
                       .SetPort(port)
                       .Finalize(newHTTPSSchemeURI);
              NS_ENSURE_SUCCESS(rv, false);
              aLoadState->SetURI(newHTTPSFragNavURI);
```
I already tested it and it seems to work.

@smaug: I would like to add something similar to the code snippet from above as an helper function to `nsHTTPSOnlyUtils.cpp` and call it in [nsDocShell.cpp](https://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#8766-8770). What are you thinking about that?

I think it could be patched by implementing in the URI check for [fragment navigations](https://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#8766-8770) a URI modifier like: https://searchfox.org/mozilla-central/source/dom/security/nsHTTPSOnlyUtils.cpp#751,779-795. 

Something that looks like: 
```C++
              // If we entered here the current scheme is https (upgraded by
              // HTTPS-Only/-First mode) and the navigation is a fragment
              // navigation. For that reason we should navigate from https to
              // https.
              nsCOMPtr<nsIURI> newHTTPSFragNavURI;
              // Port should be set to the port value of the source (URI's port  that we are navigating from)
              rv = NS_MutateURI(oldHTTPFragNavURI)
                       .SetScheme("https"_ns)
                       .SetPort(port)
                       .Finalize(newHTTPSSchemeURI);
              NS_ENSURE_SUCCESS(rv, false);
              aLoadState->SetURI(newHTTPSFragNavURI);
```
I already tested it and it seems to work.

@smaug: I would like to add something similar to the code snippet from above as an helper function to `nsHTTPSOnlyUtils.cpp` and call it in [nsDocShell.cpp](https://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#8766-8770). What are you thinking about that?