927273 - Plugin block request: Java 7 up to Update 44

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Carsten Book [:Tomcat]]

see Bug 927057 - Java 7u45 was released and 7u45 contains fixes for security vulnerabilities (i guess this means that 7u40 is vulnerable etc)

So since we block the other old versions might might block 7u40 too

Comment 1

[Masatoshi Kimura [:emk]]

We are already CTP blocking all plugins except the latest Flash Player, no?

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Masatoshi Kimura [:emk] from comment #1)
> We are already CTP blocking all plugins except the latest Flash Player, no?

Not yet, no. That's bug 914690 (for Java) and it's limited to Firefox 24 and above.

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Blocked:

Java Plugin 7 update 25 to 44 (click-to-play), Mac OS X
https://addons.mozilla.org/en-US/firefox/blocked/p459

Java Plugin 7 update 25 to 44 (click-to-play), Windows
https://addons.mozilla.org/en-US/firefox/blocked/p458

Java Plugin 7 update 25 to 44 (click-to-play), Linux
https://addons.mozilla.org/en-US/firefox/blocked/p457

Comment 5

[u279076]

Ioana, please have someone on your team test this overnight tonight and reopen if the blocks aren't working. Thanks.

Comment 6

[Ioana (away)]

Paul is the QA owner of CTP, so he'll take over this.

Comment 7

[Paul Silaghi, QA [:pauly]]

(In reply to Masatoshi Kimura [:emk] from comment #1)
> We are already CTP blocking all plugins except the latest Flash Player, no?
you're talking probably about bug 899080, but that's normal blocking, we want vulnerable blocking for java

Comment 8

[Paul Silaghi, QA [:pauly]]

(In reply to Jorge Villalobos [:jorgev] from comment #4)
> Blocked:
> 
> Java Plugin 7 update 25 to 44 (click-to-play), Mac OS X
> https://addons.mozilla.org/en-US/firefox/blocked/p459
> 
> Java Plugin 7 update 25 to 44 (click-to-play), Windows
> https://addons.mozilla.org/en-US/firefox/blocked/p458
> 
> Java Plugin 7 update 25 to 44 (click-to-play), Linux
> https://addons.mozilla.org/en-US/firefox/blocked/p457

Everything's ok on Win and Mac.
But this is NOT working on Linux. j7u25, j7u40 are not blocked.
Careful, j7u25 on Linux is called 1.7.0_25
j7u40 -> 10.40.2
j7u45 -> 10.45.2

Comment 9

[u279076]

What are the strings for these Java versions in about:plugins? Maybe the blocklist.xml regex isn't working.

Comment 10

[u279076]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #9)
> What are the strings for these Java versions in about:plugins? Maybe the
> blocklist.xml regex isn't working.

Nevermind, see https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c17. We'll need to get the strings before moving ahead.

Comment 11

[Paul Silaghi, QA [:pauly]]

Done. https://wiki.mozilla.org/QA/Plugins/About:Plugins#Linux_2

Comment 12

[u279076]

(In reply to Paul Silaghi, QA [:pauly] from comment #11)
> Done. https://wiki.mozilla.org/QA/Plugins/About:Plugins#Linux_2

Jorge, I trust the information provided by Paul is what you need to move forward with this?

Comment 13

[Jorge Villalobos [:jorgev] (he/him)]

Yes, that's enough to move forward with this.

Comment 14

[Jorge Villalobos [:jorgev] (he/him)]

I updated the regular expression for Linux. Please give it an hour or so and test again.

Comment 15

[u279076]

This block appears to be working as expected for me.

Comment 16

[Jake]

This block is ridiculous and prevents operation of many legitimate websites.

DEAR MORONS,

PLEASE REVERSE THE BLOCK ASAP, OR AT LEAST ALLOW THE USER TO ADD AN EXCEPTION.

UNLESS OF COURSE YOU WANT TO REDUCE YOUR USER BASE.

KIND REGARDS,

A. USER

Comment 17

[u279076]

(In reply to Jake from comment #16)

Jake, I respectfully ask that you familiarize yourself with https://bugzilla.mozilla.org/page.cgi?id=etiquette.html before leaving any more comments in Bugzilla.

Thank you.

Comment 18

[alex_mayorga]

https://addons.mozilla.org/en-US/firefox/blocked/p463 is wrong as it is blocking Java 7u45 that as far as the last critical patch update from Oracle at http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html is *NOT* vulnerable.

Please fix.

Comment 19

[Carsten Book [:Tomcat]]

(In reply to alex_mayorga from comment #18)
> https://addons.mozilla.org/en-US/firefox/blocked/p463 is wrong as it is
> blocking Java 7u45 that as far as the last critical patch update from Oracle
> at http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
> is *NOT* vulnerable.
> 
> Please fix.

different issue - its not that bug, its https://bugzilla.mozilla.org/show_bug.cgi?id=914690 - please see there comment #50