1198397 - We probably don't intercept HSTS upgraded channels performed through CSP upgrade-insecure-requests

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[(no longer active)]

Like bug 1198394, but a bit more fun.  :(

Comment 1

[Josh Matthews [:jdm]]

Note: the fetch spec says that the insecure request should be upgraded/blocked, and the upgraded request should have the regular interception steps applied to it.

Comment 2

[(no longer active)]

This will be fixed in bug 1198394.

Comment 3

[(no longer active)]

Attachment: Add a test for interception of requests upgraded through the CSP upgrade-insecure-requests directive

Comment 4

[(no longer active)]

Josh: ping?

Comment 5

[Josh Matthews [:jdm]]

Comment on attachment 8673305 [details] [diff] [review]
Add a test for interception of requests upgraded through the CSP upgrade-insecure-requests directive

Review of attachment 8673305 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry, I had this finished yesterday and forgot to submit it.

::: dom/workers/test/serviceworkers/fetch/upgrade-insecure/upgrade-insecure_test.js
@@ +1,3 @@
> +self.addEventListener("fetch", function(event) {
> +  if (event.request.url.indexOf("index.html") >= 0) {
> +    event.respondWith(fetch("realindex.html"));

Let's reject this if we see http://.

::: dom/workers/test/serviceworkers/mochitest.ini
@@ +92,5 @@
> +  fetch/upgrade-insecure/embedder.html
> +  fetch/upgrade-insecure/embedder.html^headers^
> +  fetch/upgrade-insecure/image.html
> +  fetch/upgrade-insecure/image-20px.png
> +  fetch/upgrade-insecure/image-40px.png

Looks like both of these are missing.

Comment 6

[(no longer active)]

(In reply to Josh Matthews [:jdm] from comment #5)
> ::: dom/workers/test/serviceworkers/mochitest.ini
> @@ +92,5 @@
> > +  fetch/upgrade-insecure/embedder.html
> > +  fetch/upgrade-insecure/embedder.html^headers^
> > +  fetch/upgrade-insecure/image.html
> > +  fetch/upgrade-insecure/image-20px.png
> > +  fetch/upgrade-insecure/image-40px.png
> 
> Looks like both of these are missing.

You're being tricked by Splinter.  :-)

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/831c479eb421

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/831c479eb421

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/831c479eb421