1014282 - ssl errors should not prompt users to "report web forgery"

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: ssl-error.png

It seems that every ssl error has the following two bullets:

* The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
* Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

The command found in the help menu is "Report Web Forgery", which leads to the Safebrowsing phish report page:

http://www.google.com/safebrowsing/report_phish/?tpl=mozilla&hl=en-US&url=https%3A%2F%2Fcloudflarechallenge.com%2F

This probably results in a ton of garbage phishing reports from Firefox to Google.

Comment 1

[[:mmc] Monica Chew (no longer reading bugmail)]

Offending line is:

http://mxr.mozilla.org/mozilla-central/source/browser/locales/en-US/chrome/overrides/netError.dtd#136

Comment 2

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Do not direct every ssl error to 'Report Web Forgery' (

Comment 3

[:Margaret Leibovic]

Comment on attachment 8426622 [details] [diff] [review]
Do not direct every ssl error to 'Report Web Forgery' (

Review of attachment 8426622 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good, you just need to update the patch to rev the entity names.

::: mobile/locales/en-US/overrides/netError.dtd
@@ -124,5 @@
>  </ul>
>  ">
>  
>  <!ENTITY nssFailure2.title "Secure Connection Failed">
>  <!ENTITY nssFailure2.longDesc "

You'll need to update the entity names, so that localizers will know to update thess strings. Something like nssFailure2.longDesc2 would suffice (that's why some of the other entity names have numbers at the end like this :).

@@ -127,5 @@
>  <!ENTITY nssFailure2.title "Secure Connection Failed">
>  <!ENTITY nssFailure2.longDesc "
>  <ul>
>    <li>The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.</li>
> -  <li>Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.</li>

This is a good fix for Fennec, because we don't even have a help menu!

Comment 4

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Do not direct every ssl error to 'Report Web Forgery' (

Comment 5

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8426698 [details] [diff] [review]
Do not direct every ssl error to 'Report Web Forgery' (

Review of attachment 8426698 [details] [diff] [review]:
-----------------------------------------------------------------

I think I got them all...

http://mxr.mozilla.org/mozilla-central/search?string=nssFailure2

Comment 6

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8426698 [details] [diff] [review]
Do not direct every ssl error to 'Report Web Forgery' (

Review of attachment 8426698 [details] [diff] [review]:
-----------------------------------------------------------------

missed one

Comment 7

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Do not direct every ssl error to 'Report Web Forgery' (

Comment 8

[[:mmc] Monica Chew (no longer reading bugmail)]

Comment on attachment 8426702 [details] [diff] [review]
Do not direct every ssl error to 'Report Web Forgery' (

Review of attachment 8426702 [details] [diff] [review]:
-----------------------------------------------------------------

One of the strings did not change, but I updated the name anyway because I'm not sure which xhtml reference which dtds.

Comment 9

[:Margaret Leibovic]

(In reply to [:mmc] Monica Chew (please use needinfo) from comment #8)
> Comment on attachment 8426702 [details] [diff] [review]
> Do not direct every ssl error to 'Report Web Forgery' (
> 
> Review of attachment 8426702 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> One of the strings did not change, but I updated the name anyway because I'm
> not sure which xhtml reference which dtds.

It's good to update all of them because the browser/mobile .dtd files override the dom .dtd file, so the same xhtml file could be pulling from either one depending on which product is being used.

This netError stuff is confusing :/

Comment 10

[:Gavin Sharp [email: [e-mail]]]

FWIW that text is a reference to the feature we removed in bug 572695.

Comment 11

[:Margaret Leibovic]

Comment on attachment 8426702 [details] [diff] [review]
Do not direct every ssl error to 'Report Web Forgery' (

Review of attachment 8426702 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.

Comment 12

[:Margaret Leibovic]

(In reply to :Gavin Sharp (email [e-mail]) from comment #10)
> FWIW that text is a reference to the feature we removed in bug 572695.

I wrote that patch on my first day of full-time work at Mozilla!

Comment 13

[[:mmc] Monica Chew (no longer reading bugmail)]

Wow, Gavin's hg blame fu is pretty amazing :)

https://hg.mozilla.org/integration/mozilla-inbound/rev/184d497bd84a

Comment 14

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/184d497bd84a