Closed Bug 1077891 Opened 5 years ago Closed 5 years ago

HSTS preload update removed everything, because the update script is broken

Categories

(Core :: Security: PSM, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla35
Tracking Status
firefox34 --- unaffected
firefox35 + fixed

People

(Reporter: philor, Assigned: keeler)

References

Details

(Keywords: regression)

Attachments

(1 file)

https://hg.mozilla.org/mozilla-central/rev/b3fb5bdc588c

Prolly should have written those bug 905852 tests, somehow, or set up that cronjob to run it Friday afternoon and mail the results to you, or added code to make it abort if a sanity-check hits an unexpected error, or to make it abort if it's going to remove everything.
Duplicate of this bug: 1077946
This looks like a regression from the extra parameter added in https://hg.mozilla.org/mozilla-central/rev/aeacfe204b8d .

[Tracking Requested - why for this release]:
I'm not sure how bad this is; hoping somebody else can comment.
Attached patch patchSplinter Review
I forgot that this script uses nsISiteSecurityService to parse HSTS headers when we updated the interface for HPKP.
Note that the situation is not as bad as the summary indicates. Due to the mechanism that doesn't remove sites from the list unless we can connect to them and see that they either don't send the header anymore or send it with max-age:0, no hosts that still send the header were actually removed from the list as a result of this failure (robteix.com was removed because it doesn't send the header, as far as I can see).
Assignee: nobody → dkeeler
Status: NEW → ASSIGNED
Attachment #8500586 - Flags: review?(mmc)
Attachment #8500586 - Flags: review?(mmc) → review+
https://hg.mozilla.org/mozilla-central/rev/0c7760746689
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
You need to log in before you can comment on or make changes to this bug.