1123969 - The about:certerror page for a view-source:https://[whatever] URL is missing the domain name.

Status: RESOLVED DUPLICATE of bug 941354

(Firefox :: Security, defect)

Description

[Daniel Holbert [:dholbert]]

STR:
 1. Visit any of these URLs (including the "view-source:" prefix):
    view-source:https://tv.eurosport.com

    view-source:https://builddata.pub.build.mozilla.org/

    view-source:https://whitehouse.gov/

  (It's important that these URLs are for misconfigured servers which use an invalid cert, and hence take you to a certerror page.)

 2. Inspect the certerror page that you arrive at.

ACTUAL RESULTS: The page says:
> You have asked Nightly to connect securely to ,
> but we can't confirm that your connection is secure.

Note the blank space and comma, where a domain-name should be.

EXPECTED RESULTS:
The domain name should be included in the message (as it is if you strip out the "view-source:" prefix).


(I just hit this in the wild, when clicking a link to some source in my error console, which pointed to a source file that happened to be hosted on a misconfigured server. So the "source view" popup window showed this bogus about:certerror page with no domain name.)

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: screenshot

Comment 2

[Daniel Holbert [:dholbert]]

As shown in the screenshot, the domain *is present* in the "Technical Details" area (which is closed by default), but it's missing from the first paragraph of the page.

Comment 3

[Daniel Holbert [:dholbert]]

I'm using Nightly 38.0a1 (2015-01-20)
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0

Comment 4

[Daniel Holbert [:dholbert]]

Attachment: screenshot *without* "view-source:" in URL, for comparison

Comment 5

[:Gijs (he/him)]

Yeah, this will be because the view-source URL itself doesn't have a host. We would need to specialcase it and ask the nested URI for a host.

Comment 6

[u564464]

This is reproducible in newer versions (incl 51.0.1) that have the updated Insecure Connection page UI, albeit the wording on the page is different.

view-source:https://builddata.pub.build.mozilla.org/
"The owner of has configured their website improperly."

Expected: "The owner of builddata.pub.build.mozilla.org has configured their website improperly."

Comment 7

[:Gijs (he/him)]

This doesn't seem to work at all anymore - no page loads at all (tested with view-source:https://expired.badssl.com/ ), in both nightly and 76. :-(

Wonder if this is to do with the fission-related actor refactor or document channels. Johann, can you take a look? I don't mind too much about view-source, but I'm worried what else we're missing in this way.

Comment 8

[Johann Hofmann [:johannh]]

We noticed the same thing on bug 941354. I haven't investigated yet.

view-source: for a cert error is completely broken, as bug 941354 says. So maybe we can just dupe this one?

Comment 9

[Johann Hofmann [:johannh]]

Some more details in https://bugzilla.mozilla.org/show_bug.cgi?id=941354#c38 but it's all generally really weird.

Comment 10

[Daniel Holbert [:dholbert]]

(In reply to Johann Hofmann [:johannh] from comment #8)

view-source: for a cert error is completely broken, as bug 941354 says. So maybe we can just dupe this one?

Sure, that's fine with me.