394880 - malware test page at http://www.mozilla.com/firefox/its-an-attack.html

Status: VERIFIED FIXED

(www.mozilla.org :: General, defect)

Description

[Dave Camp (:dcamp)]

The malware detection feature flags http://www.mozilla.com/firefox/its-an-attack.html as malware, similar to the its-a-trap.html for safebrowsing.  We should probably have content there for non-ffx3 browsers.

Reed mentioned disabling the redirects for this page.  The malware protection will block redirects from a flagged page, so it might not be necessary to do that.

Comment 1

[Reed Loden [:reed]]

I took the its-a-trap page and modified a couple of things just for playing around. It's only on the trunk for now. Over to Steven to come up with a much better version of the page and new images, etc. pkim, I guess we'll need /firefox/malware-protection/ like we have /firefox/phishing-protection/?

Sending        trunk/.htaccess
Adding         trunk/en-US/firefox/its-an-attack.html
Transmitting file data ..
Committed revision 6643.

Comment 3

[Wil Clouser [:clouserw]]

Pascal brought up a good point in Bug 396543 - why is this not a localized page?  Meaning, why isn't it using the /$locale/firefox/its-an-attack.html structure?

Comment 4

[Reed Loden [:reed]]

(In reply to comment #3)
> Pascal brought up a good point in Bug 396543 - why is this not a localized
> page?  Meaning, why isn't it using the /$locale/firefox/its-an-attack.html
> structure?

It can't be localized because "http://www.mozilla.com/firefox/its-an-attack.html" is hardcoded into Firefox as a test page, and if that page redirects to another site, that new site will not be detected as the same page. Also, dcamp has mentioned that the malware blocking code stops redirects from happening, so that's another strike against localized versions of the page.

Comment 5

[Wil Clouser [:clouserw]]

Yeah, my question was more "why are we hardcoding that string into firefox instead of a localized version?"  but it might be too late for that now.

Comment 6

[Johnathan Nightingale [:johnath]]

I think reed's second point is the kicker.  Malware blocking doesn't let redirects slip past, since that would be an easy way to avoid blacklists - spam a URL and then redirect to some randomized-DNS.  We might do some kind of once-off magic on the actual page (JS localization, anyone?) but it feels like the typical locale-based-redirect approach will fail here (unless we yank the current entry page from the blacklist, and instead add the 50 localized landing pages instead).

Comment 7

[Pascal Chevrel:pascalc (PTO until April 26)]

if we can't change the location, this page should be served uncached with PHP localization and not javascript

Comment 8

[Wil Clouser [:clouserw]]

The original comment says "we should probably have content there" and we do so I'm resolving this.  If someone wants to talk about l10n we can do that in another bug.

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

What clouserw said: verified FIXED