1217236 - Tracking protection: Resources on blocklist not blocked when accessed via Flash movies

Status: VERIFIED FIXED

(Toolkit :: Safe Browsing, defect)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

A SWF that loads a resource that is on our Tracking Protection blocklist is currently able to do so. This is wrong. This issue may affect the NPAPI in general.

Note:
Please contact me for bug files. Reproducing this requires a custom blocklist, an emulated local shavar server and a custom Flash movie. I'm happy to stage something when we get around to looking at it.

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

This SWF loads the blocked URL "http://www.adjuggler.com/images/logo-ad-juggler.png":

http://people.mozilla.org/~mwobensmith/tracking_protection/flash.html

Comment 2

[François Marier [:francois]]

Attachment: bug1217236.patch

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/deda2ab53734

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/deda2ab53734

Comment 5

[Matt Wobensmith [:mwobensmith][:matt:]]

Looks to be fixed in latest Nightly 45, but the shield icon does not appear, despite having a blocked resource. Are we tracking that in another bug, or should I file a new one?

Comment 6

[François Marier [:francois]]

You're right, it also looks like the devtool console message isn't there. This needs a new bug.

Comment 7

[Matt Wobensmith [:mwobensmith][:matt:]]

Marking verified, and filed new bug 1232487 to track the lack of shield icon and console message.