1015631 - Mixed content blocking doesn't check intermediate redirects

Status: RESOLVED DUPLICATE of bug 418354

(Core :: DOM: Security, defect)

Description

[Michal Zalewski]

Hey,

Mixed content checking doesn't appear to catch a situation where the initial URL is HTTPS, results in a redirect to HTTP, and that again redirects to HTTPS. One example of this would be something like:

<script src="https://www.example.com/whatever_v1.js">

...that mistakenly redirects to:

http://www.example.com/whatever_v2.js

...and that then gets upgraded back to HTTPS:

https://www.example.com/whatever_v2.js

On open wifi, active attackers could intercept that middle redirect and make it point to https://www.evil.com/evil.js, so this is obviously undesirable. Chrome detects and blocks this redirect.

Test case: go to a HTTPS site like https://www.paypal.com and try this in the console:

s=document.createElement('script');s.src='https://1-ps.googleusercontent.com/h/lcamtuf.coredump.cx/mixme1.cgi';document.body.appendChild(s)

Note that the redirect chain goes through a HTTP step.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

I don't think this needs to be a hidden bug.

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

tanvi - do you agree on opening this bug?

Comment 3

[Daniel Veditz [:dveditz]]

You don't even need to redirect back to https, we just don't handle redirects in the initial implementation.

Comment 4

[Tanvi Vyas[:tanvi]]

Yes, we can open this up.  This is a known issue which will be fixed as part of bug 1006868.