106659 - lock icon out of sync

Status: VERIFIED WORKSFORME

(Core Graveyard :: Security: UI, defect, P1)

Description

[Judson Valeski]

Problem: visiting said URL shows an either broken, or locked security icon, even
though there is no "https" content on the page. However, there are a couple of
https links on the page, but, AFAIK, those should not be causing lock icon activity.

Steps to repro:
1. load the said URL.
2. notice the lock icon is either locked, or broken (it should be neither).

Comment 1

[Shotaro Kamio]

also happened in  Mozilla0.9.5/Linux 2001101202

Comment 2

[Judson Valeski]

updating OS all (I've seen this on win2k and win98). This happens in embedded
apps too.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

->PSM

Comment 4

[Stephane Saux]

->ddrinan

reproduced using OTIS 10/29 build.

Comment 5

[Jeremy M. Dolan]

Seeing this on Linux too. I also got the warning dialog about viewing a page
with a mix of enc/unenc content.

Comment 6

[John Flynn]

Verified this on 2001121321. Lock icon stays "locked" even though I've already
left all pages that have any https content.

It seems that the lock icon goes from unlocked to locked but can't go back
again. Also, lock icon stays locked when switching tabs from an https page to a
non-https page.

This is very serious, as it can mislead people into thinking their connection is
encrypted when it is not. I'd rather the lock icon stay unlocked than be locked
when it shouldn't!

Comment 7

[Jeremy M. Dolan]

Now I don't get the "mix of enc/unenc content", I just get one saying I'm about
to view an encrypted page. (Reset your SSL dialog prefs).

I checked with 'wget', and it doesn't redirect to an https URL.

And I checked the source... there are two https links, but no content is loading
via https.

Comment 8

[John Unruh]

WFM with the 2/15 Win2000 trunk build.

Comment 9

[John Unruh]

Verified.