1077891 - HSTS preload update removed everything, because the update script is broken

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/b3fb5bdc588c

Prolly should have written those bug 905852 tests, somehow, or set up that cronjob to run it Friday afternoon and mail the results to you, or added code to make it abort if a sanity-check hits an unexpected error, or to make it abort if it's going to remove everything.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This looks like a regression from the extra parameter added in https://hg.mozilla.org/mozilla-central/rev/aeacfe204b8d .

[Tracking Requested - why for this release]:
I'm not sure how bad this is; hoping somebody else can comment.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: patch

I forgot that this script uses nsISiteSecurityService to parse HSTS headers when we updated the interface for HPKP.
Note that the situation is not as bad as the summary indicates. Due to the mechanism that doesn't remove sites from the list unless we can connect to them and see that they either don't send the header anymore or send it with max-age:0, no hosts that still send the header were actually removed from the list as a result of this failure (robteix.com was removed because it doesn't send the header, as far as I can see).

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0c7760746689

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0c7760746689