1223114 - NPN_GetURLNotify fails at HTTP request from site with HSTS

Status: RESOLVED WONTFIX

(Core :: Security, defect)

Description

[Rinat]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0 Iceweasel/42.0
Build ID: 20151104000845

Steps to reproduce:

Make NPAPI plugin to request a HTTP resource from a site which have HSTS (Strict Transport Security) set. In my case those was "http://www.youtube.com/crossdomain.xml" and "https://www.youtube.com" respectively


Actual results:

browser calls NPP_URLNotify() with reason=NPRES_NETWORK_ERR, no data is feeded to a plugin


Expected results:

browser should pass data via NPP_Write() calls.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Isn't this just being blocked by the mixed content security policy?  Why do you expect this to work given that policy?

Comment 2

[Rinat]

> Isn't this just being blocked by the mixed content security policy?

Thought about mixed content blocking, but if I remove HSTS flag from www.youtube.com
(there is an extension https://addons.mozilla.org/en-US/firefox/addon/enforce-encryption/
which can set or remove that flags), http request from https is served fine.
(To reiterate, this is a plugin who makes the request, not an HTML document.)

Does mixed content security policy apply to NPAPI plugins?

Comment 3

[Boris Zbarsky [:bzbarsky]]

> Does mixed content security policy apply to NPAPI plugins?

I thought it did.  Christoph, do you know who'd know for sure?  Tanvi seems to not be accepting needinfo requests...

Comment 4

[Tanvi Vyas[:tanvi]]

If a plugin makes a request, we consider it TYPE_OBJECT_SUBREQUEST.  That goes through Mixed Content Blocker and is treated as mixed passive content.  Mixed passive content is not blocked by default and should load on the page.  Double check that your security.mixed_content.block_display_content pref is set to false.

Can you provide me with a test case?

Comment 5

[Christoph Kerschbaumer [:ckerschb, back on Aug 10th}]

(In reply to Tanvi Vyas - out 11/11 [:tanvi] from comment #4)
> If a plugin makes a request, we consider it TYPE_OBJECT_SUBREQUEST.  That
> goes through Mixed Content Blocker and is treated as mixed passive content. 
> Mixed passive content is not blocked by default and should load on the page.

I am convinced that mixed content would block such a load. To be sure you could open the web console or browser console and see if mixed content blocker logs a warning.

Comment 6

[Rinat]

// Here is a test plugin source

// filename: plugin-1223114-v1.c

// gcc -fPIC -fvisibility=hidden -shared -o libtest-1223114-v1.so plugin-1223114-v1.c

#include "npfunctions.h"
#include <stdio.h>
#include <string.h>

#define MIN(a,b) ({ typeof(a) _a = (a); typeof(b) _b = (b); _a < _b ? _a : _b; })

static NPNetscapeFuncs     npn;

NPError
NPP_SetWindow(NPP npp, NPWindow *window)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

NPError
NPP_New(NPMIMEType pluginType, NPP npp, uint16_t mode, int16_t argc, char *argn[],
        char *argv[], NPSavedData *saved)
{
    NPError err;
    printf("%s\n", __func__);

    err = npn.geturlnotify(npp, "http://www.youtube.com/crossdomain.xml", NULL, (void *)0x1234);
    printf("  npn.geturlnotify returned %d\n", err);

    return NPERR_NO_ERROR;
}

NPError
NPP_Destroy(NPP npp, NPSavedData **save)
{
    printf("%s\n", __func__);
    if (save)
        *save = NULL;
    return NPERR_NO_ERROR;
}

NPError
NPP_NewStream(NPP npp, NPMIMEType type, NPStream *stream, NPBool seekable, uint16_t *stype)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

NPError
NPP_DestroyStream(NPP npp, NPStream *stream, NPReason reason)
{
    printf("%s npp=%p, stream=%p, reason=%d\n", __func__, npp, stream, reason);
    return NPERR_NO_ERROR;
}

int32_t
NPP_WriteReady(NPP npp, NPStream *stream)
{
    printf("%s npp=%p, stream=%p\n", __func__, npp, stream);
    return 1024*1024;
}

int32_t
NPP_Write(NPP npp, NPStream *stream, int32_t offset, int32_t len, void *buffer)
{
    printf("%s npp=%p, stream=%p, offset=%d, len=%d, buffer=%p\n", __func__, npp, stream, offset,
           len, buffer);
    return len; // pretend we are reading
}

void
NPP_StreamAsFile(NPP npp, NPStream *stream, const char *fname)
{
    printf("%s\n", __func__);
}

void
NPP_Print(NPP npp, NPPrint *platformPrint)
{
    printf("%s\n", __func__);
}

int16_t
NPP_HandleEvent(NPP npp, void *event)
{
    printf("%s\n", __func__);
    return 1;
}

void
NPP_URLNotify(NPP npp, const char *url, NPReason reason, void *notifyData)
{
    printf("%s npp=%p, url=%s, reason=%d, notifyData=%p\n", __func__, npp, url, reason, notifyData);
}

NPError
NPP_GetValue(NPP npp, NPPVariable variable, void *value)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

NPError
NPP_SetValue(NPP npp, NPNVariable variable, void *value)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

NPBool
NPP_GotFocus(NPP npp, NPFocusDirection direction)
{
    printf("%s\n", __func__);
    return 1;
}

void
NPP_LostFocus(NPP npp)
{
    printf("%s\n", __func__);
}

void
NPP_URLRedirectNotify(NPP npp, const char *url, int32_t status, void *notifyData)
{
    printf("%s\n", __func__);
}

NPError
NPP_ClearSiteData(const char *site, uint64_t flags, uint64_t maxAge)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

char **
NPP_GetSitesWithData(void)
{
    printf("%s\n", __func__);
    return NULL;
}

void
NPP_DidComposite(NPP npp)
{
    printf("%s\n", __func__);
    return;
}

__attribute__((visibility("default")))
const char *
NP_GetMIMEDescription(void)
{
    printf("%s\n", __func__);
    return "application/x-test-1223114::test1223114";
}

__attribute__((visibility("default")))
char *
NP_GetPluginVersion(void)
{
    printf("%s\n", __func__);
    return (char *)"v1";
}

__attribute__((visibility("default")))
NPError
NP_GetValue(void *instance, NPPVariable variable, void *value)
{
    printf("%s\n", __func__);

    switch (variable) {
    case NPPVpluginNameString:
        *(const char **)value = "test1223114 plugin";
        break;
    case NPPVpluginDescriptionString:
        *(const char **)value = "test1223114 description";
        break;
    default:
        printf("    not implemented variable %d\n", variable);
    }

    return NPERR_NO_ERROR;
}

__attribute__((visibility("default")))
NPError
NP_Initialize(NPNetscapeFuncs *aNPNFuncs, NPPluginFuncs *aNPPFuncs)
{
    printf("%s\n", __func__);

    memset(&npn, 0, sizeof(npn));
    memcpy(&npn, aNPNFuncs, MIN(sizeof(npn), aNPNFuncs->size));

    NPPluginFuncs pf;
    memset(&pf, 0, sizeof(NPPluginFuncs));
    pf.size = MIN(aNPPFuncs->size, sizeof(NPPluginFuncs));

    pf.newp =               NPP_New;
    pf.destroy =            NPP_Destroy;
    pf.setwindow =          NPP_SetWindow;
    pf.newstream =          NPP_NewStream;
    pf.destroystream =      NPP_DestroyStream;
    pf.asfile =             NPP_StreamAsFile;
    pf.writeready =         NPP_WriteReady;
    pf.write =              NPP_Write;
    pf.print =              NPP_Print;
    pf.event =              NPP_HandleEvent;
    pf.urlnotify =          NPP_URLNotify;
    pf.getvalue =           NPP_GetValue;
    pf.setvalue =           NPP_SetValue;
    pf.gotfocus =           NPP_GotFocus;
    pf.lostfocus =          NPP_LostFocus;
    pf.urlredirectnotify =  NPP_URLRedirectNotify;
    pf.clearsitedata =      NPP_ClearSiteData;
    pf.getsiteswithdata =   NPP_GetSitesWithData;
    pf.didComposite =       NPP_DidComposite;

    memcpy(aNPPFuncs, &pf, pf.size);

    return NPERR_NO_ERROR;
}

__attribute__((visibility("default")))
NPError
NP_Shutdown(void)
{
    printf("%s\n", __func__);
    return NPERR_NO_ERROR;
}

Comment 7

[Rinat]

I'm using the following page to launch the test plugin:

<!DOCTYPE html>
<!-- index.html -->

<html>
<body>
<embed type="application/x-test-1223114"
       style="border: 1px solid black; width: 400; height: 300;"/>
</body>
</html>


Previously, I used Youtube, so www.youtube.com have strict transport security
flag set. And I see in stdout:

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_URLNotify npp=0x7fc4cf5d1490, url=http://www.youtube.com/crossdomain.xml, reason=1, notifyData=0x1234
NPP_SetWindow
NPP_SetWindow
NPP_SetWindow
NPP_Destroy
NP_Shutdown

If I then reset STS flag from www.youtube.com (see link in #c2), output changes to:

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_NewStream
NPP_WriteReady npp=0x7f15e28d1490, stream=0x7f15e28bc440
NPP_Write npp=0x7f15e28d1490, stream=0x7f15e28bc440, offset=0, len=306, buffer=0x7f15dfe13288
NPP_DestroyStream npp=0x7f15e28d1490, stream=0x7f15e28bc440, reason=0
NPP_URLNotify npp=0x7f15e28d1490, url=http://www.youtube.com/crossdomain.xml, reason=0, notifyData=0x1234
NPP_SetWindow
NPP_SetWindow
NPP_SetWindow
NPP_Destroy
NP_Shutdown

Comment 8

[Rinat]

(In reply to Tanvi Vyas - out 11/11 [:tanvi] from comment #4)
> Can you provide me with a test case?

See comments above

Comment 9

[Rinat]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #5)
> I am convinced that mixed content would block such a load. To be sure you
> could open the web console or browser console and see if mixed content
> blocker logs a warning.

There are two cases. With HSTS flag set I don't see anything in console
(all message types enabled, including Security). With HSTS flag not set
I see a GET request to http://www.youtube.com/crossdomain.xml.

The page I'm testing is loaded from local file, i.e. file:///

Comment 10

[Tanvi Vyas[:tanvi]]

I'm not sure how to use these test cases.  Do you have a live test case I can click on?  Please copy/paste the output of your webconsole here.

If the HSTS flag is set for a domain, then HTTP requests will not be made.  If your plugin requests http://www.youtube.com/crossdomain.xml and youtube.com has the HSTS flag set, the browser will not attempt to load http://www.youtube.com.  It will only allow loads to https://www.youtube.com.

It sounds like when you remove the HSTS flag from youtube, http://www.youtube.com loads, which is expected.

Comment 11

[Rinat]

(In reply to Tanvi Vyas [:tanvi] from comment #10)
> I'm not sure how to use these test cases.  Do you have a live test case I
> can click on? 

I don't think that's possible. It's a plugin, a native library (like Flash or
Java plugin). Unless one installs plugin on their system, it cannot be tested.
That's why there is a C source file in a testcase.

I'm using GNU/Linux (Debian). To compile plugin, I use gcc (you can find a full
command line in the example code). Then move libtest-1223114-v1.so into
~/.mozilla/plugins. To be sure plugin was loaded, I restart browser, open a
single tab with index.html from the example above.

> Please copy/paste the output of your webconsole here.

When index.html loads, I see following in web console:

Error in parsing value for 'width'.  Declaration dropped. index.html
Error in parsing value for 'height'.  Declaration dropped. index.html
The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol. index.html

Since I use click-to-play, plugin is not loaded, there is a gray box with
"Activate test1223114" (plugin name). I click it, then click "Allow Now"
button in confirmation dialog, and the plugin loads. No additional messages
appears in the web console.

However, if I remove HSTS flag from domain www.youtube.com, I can see
"GET 
http://www.youtube.com/crossdomain.xml [HTTP/1.1 200 OK 0ms]" message in
the web console.

> If the HSTS flag is set for a domain, then HTTP requests will not be made. 
> If your plugin requests http://www.youtube.com/crossdomain.xml and
> youtube.com has the HSTS flag set, the browser will not attempt to load
> http://www.youtube.com.  It will only allow loads to https://www.youtube.com.
> 
> It sounds like when you remove the HSTS flag from youtube,
> http://www.youtube.com loads, which is expected.

I'd expect it to transparently redirect from HTTP to HTTPS. Was my assumption
wrong?

Comment 12

[Tanvi Vyas[:tanvi]]

(In reply to Rinat from comment #11)
> > If the HSTS flag is set for a domain, then HTTP requests will not be made. 
> > If your plugin requests http://www.youtube.com/crossdomain.xml and
> > youtube.com has the HSTS flag set, the browser will not attempt to load
> > http://www.youtube.com.  It will only allow loads to https://www.youtube.com.
> > 
> > It sounds like when you remove the HSTS flag from youtube,
> > http://www.youtube.com loads, which is expected.
> 
> I'd expect it to transparently redirect from HTTP to HTTPS. Was my assumption
> wrong?
Yes, you are right.  The request should be internally redirected to https://www.youtube.com.

Comment 13

[Tanvi Vyas[:tanvi]]

Have you tried this on a fresh Firefox profile?

Would you be able to provide the plugin binary?

Comment 14

[Rinat]

(In reply to Tanvi Vyas [:tanvi] from comment #13)
> Have you tried this on a fresh Firefox profile?

Just tried. For some reason www.youtube.com doesn't set HSTS flag.
Perhaps it did before, or I just did set flag myself, I don't
remember for sure.

But after setting the HSTS flag (had to install that addon, Enforce Encryption,
to set it), I could reproduce the issue.

> Would you be able to provide the plugin binary?

Library is quite small, I can post it here. Data below is base64 encoding
of libtest-1223114-v1.so.xz binary. You can then convert it with "base64 -d"
and unpack with "xz -d".

/Td6WFoAAATm1rRGAgAhARwAAAAQz1jM4Bw3Ca9dAD+RRYRoPYmm2orhgzJO2Qelld9uIJngGIyZ
qk93sckhvr7vMczsu6obfshgeYXLlppbN7fhq/xNoZMp6mHFgfgPQvYOWMkKjnX/gJpKS/XvFCf8
UnCfUJxiiu47UZCpDqrseSY0h0tg4EomNlPxhyPyNENTldp0cgDLTPHA1wBvRzo3YuTaoCvkGPUk
G55zBBT5ke+OE+55jjE2P7L1y0zZsXywQhF3J1TIIOwBp/tSV41o0IEwG+tmsldqdQ2qbT+DMVnT
hQkNffk4rW+HyM7nEC3IcNriOhiB9y9l6FWgzVZkBAbHZyNnP0O1D5bFuWcqOMYLjdGTqup7iKiu
R9ZsJfFmp0rxcMDXsVE/etkol2QiT8eRooKfXEW7WornbpIaJZsHqptWWJ2jUdi55rhyOxVvfo+t
q/E+rObWAngq8Btcd4Opu7RQ1jeRzfY2HHN63CgBwMxHOKPeqeoR6XIiZ5+zhZY/5sORvqv2IQ+2
9aDGSx0TVtPI5cEx8Q6yl/EccsluTSwipU/rUM0jDRw6qck8IR/73nOx7TbZGgY3Cy/arY9VODCB
xwFJl42uZwHa/w109/bmDMh/l00K4cQApod8ECn2xP76LWHwZArMRE16O5kVRSIpe1hS8AulhClj
TGyj3oz+ZyC4jgtuEDt1dxc5t23n6JYfgyeJr12MMQM1S4IOuxQjYiUG1zJKXr0dWPzajd/sb8rF
BD9uwHdTmE8IQlY9U3tyQcFUnAkQWdH7C3bLkt1bSZOJ55SoeGzQzCJJbB4bacGCjEvSQpGLVomt
XEVACHrT8uJv47rXjRglZco1E0gGbng/WwbHK0lUGBsxygaNJ5boWTQnrOKQaANW1UR64wQiukz8
XdsjYQ0UoDyX4t5LXv2CMzp7TSVX8ezUEPnno7ddXKsIpYPIXpWZT/DIbFaPMaDhDFdDb86HOKiu
fmIhOWBtv7tFUvtb2iyW7tkdYpZ9iAtUY3tNs9GSMuRvzU4FuoLgdCaFWVmkg/BjSSrHYujow87e
ANXU+QwmFzwPtRhZTLRNhwYVKdYBeCnGYmSogRAO9ovk77g+9yddqIH+3/oNYataR2jwEw6q+b2t
5F36N/ms8Xka6NJo0m/KIDqBBgnCwHVEVDpvpwyOLXVpDm+1yz/+sdgyRST4KQlYBvYOQgoNVH0Y
AFfuE9h5b2xDVKNDMkpP2/3hjFSnbhSflVPzoy+1pLQprf0AGCc7cMByR0a0SEV7OAdnHmaEcw3M
ImT98Wo48csJVbGAFgMnG0L4qbfSpT5TL/xxYT2uw4Ghv8ozckHng4eIq3yBBwehIXXNllf+M5ns
vzDOCDXjspDl7VZInDDjaM1KdDJl1N9VLWZSzDIwd4t6to1M7fG2d1ltYepN9iLjfruTI/RqsByG
Kqt1E8+1RxeKk+9CYU/NMEnkRWcQomR6xOhQz8nqwsmpaIWek9lp3nV+HFcj0GXoV6iNnayIYuxv
PYhyAgS0hYdzV2cER1H5CVhKYiLNFcdtXQAztpI6JqJnvNyv9UTjVOzUOkuTzft24mnPAUAO/n2c
ga/5jZHLt02fNo3MU7o4lPBJ1M8Z+Eu69muScdK63VnCSFgTwIMEjQF9Zg/xgFKzlH+e0bMz533h
ABa6Yl9wr3IeY05bQ1Qh5viTwcy9UpMW5c1gSBy3Fw95A7XaHSrYQcjemWrkleUYJTVeongB/dRj
AINpry9FRWVRdameA9atq6R/HZpRj72N6XrNb3WGhgyE/QyYT4MWIko+ZJ+qnVQNPwemYFp15gpa
Dj1GFBRC8bEmDj6Y1SruNznYciNnvnrfj/TcPwQ717MlGSI2aM+9NopECHoQwa3ULXYn1elBzmBW
JEm/AZHMKGP11DCpRIIWlwZ1Db8ewaAbSxuCyu+MRphxV9oabfuwKvyjKtuGhp6sj8waGGQUPUfY
18Z9ruTeFjpf+H3S2Y7VE2DsDUEw3tpCjh3WdjqEVlb6V+mqMHhAP4TiYKIzxh9fVnOVy+/msF5Q
BFtB1JzCy/8JqwvM+sFVg/b9aMGFGtdCp2ZzKiFKG/3iPYxsbMicyy8NMBrcwivtgWfZ7nrdT8qV
mMWpsHCPfQkzf7nEAPl/uOOAMZkdU+ezt1hMlCpOWFS0GCRvfNi6CNIAuTk92UOXMGpYnoWJNmF1
7iNiTErXkGRh9o2YeHYkeLEnRBXs6sk7JbECdhHEu4ihTUM474DPZdb/IUEMT5qSExc/sCjeoiTm
2fWxGO8/YQlX5aWUudEFUPbTTKyjPQ7PMz2KohmOV2Wd0xugXvA1MagOO5MqNNSrQSilh+q6fufU
UO1ZIF5wUpVtHne87PY0bn1JvdjeJaKUWLIKwVEO0xut4DmPq+bbH3RL8LGfovCjCdAInRsrdr2U
Q1MZ1xgwYOLE1mx9cpzW0PpZ/JdIjHorqVZSDsaWQa9VsCGyka9efKVIyDKYLwyF4WwGoFcDwD34
EIu3zqNKTwMGOswIEh+q4Nmk9liuzVhPhuKOYFyca2HIcQUWRj0l+9afxATbwfM8cgTWoOEGzbJb
VV0GLlmFUexHV0i3tNWl27f6AH/w2974p1XxN+ErmyHfFo/BIV7zmDTzasz5z40JSely+3ODejua
5Q5fbxLjKdHd4o/OsonRx3h4/ysuFY1KSAx7399h+fi6h6sixvXD+Z+IZ9TsNC6e8a1GXyXOunfS
/ND2h9VS98dk+JX4I7SjdAx4Mbxrgtn1WitMbxBapepLAk5SZb9YvBWAvzn2GbryP7eg05YNsB35
I0ARTB6xmW+46U2SRWMm8EqgoYCPRASz7DQMPPlRyy8NEib5xWhgi+qaGTSesyYz3nZcfSdtobm0
R6y3i9u/Gs6yUgq9YYam9f0w8EAh42FCb6TnvWC41VS3yqba/r1Tj8R47QnsGvGEFfEORUgyrx7Q
7Pe+OG+RAzADFGkFh2M/vpdNJhzus3S/cJBJxIlCib+hjDoKFtTYEPnvl9tzXqjPYiTGoGhAmKl7
7WrpKLDNiEtMK+lngiv+HHtituqCnGxMoZPYTcEGEeqaJdXhXhGoZaVHajGq85+A934h6wi9NlZf
ugES+URJw5S7TxniQdp1pMuwQAt3BITNH7cAD06rnHORhI/2MM9F0DpOXCVuEY6StDazNsPZfMbF
POnguOESP6u2sBS7lp9gPB9hdEADHAEk0VnGywzlS8AU83Yxj+/gVYIIubEFAyAA/bcq1JvyAwku
/i4D1XMS+sgWlPp6EV7A+yxWEOVl7WYAqRYFnGWMqVKVZxxIzRjJNEdMQoIGtiiGn2RyttzUAKEH
fwIAAGHreHD0YxM3AAHLE7g4AAClBYRtscRn+wIAAAAABFla

Comment 15

[Kamil Jozwiak [:kjozwiak]]

Attachment: poc.zip

Initially when I loaded youtube.com in the latest m-c, it appeared as "HTTP Strict Transport Security: Disabled". I got this information by looking at the "Security" portion of the network tool provided via the developer tools. I ran the plugin that I compiled via comment # 6 and received the result that I listed below via the "Disabled" header.

I downloaded/installed the enforce-encryption add-on via comment # 2 and enabled "start enforcing" via "Page Info -> Security". I loaded youtube.com once again and made sure that "HTTP Strict Transport Security: Enabled" in the network tool via the developer tools. I ran the plugin once again and received the results that I listed below via the "Enabled" header.

STR: (Used Ubuntu 14.04.3 x64 via VM)
* unzip poc.zip
* move libtest-1223114-v1.so into /usr/lib/mozilla/plugins/
* launch fx via ./firefox-bin
* open the index.html (drag and drop the file into fx)
* Activate the plugin

HTTP Strict Transport Security: Disabled
========================================
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_NewStream
NPP_WriteReady npp=0x7f9509648550, stream=0x7f950c6f9620
NPP_Write npp=0x7f9509648550, stream=0x7f950c6f9620, offset=0, len=306, buffer=0x7f9509657148
NPP_DestroyStream npp=0x7f9509648550, stream=0x7f950c6f9620, reason=0
NPP_URLNotify npp=0x7f9509648550, url=http://www.youtube.com/crossdomain.xml, reason=0, notifyData=0x1234
NPP_GetValue
NPP_Destroy
NP_Shutdown

HTTP Strict Transport Security: Enabled
=======================================
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_URLRedirectNotify
NPP_SetWindow
NPP_URLNotify npp=0x7f7b4b944150, url=http://www.youtube.com/crossdomain.xml, reason=2, notifyData=0x1234
NPP_Destroy
NP_Shutdown

Comment 16

[Tanvi Vyas[:tanvi]]

So it sounds like either the addon (https://addons.mozilla.org/en-US/firefox/addon/enforce-encryption/) is not working correctly, or Firefox doesn't apply HSTS to crossdomain.xml files (and maybe TYPE_OBJECT_SUBREQUESTS in general).

Instead of youtube.com, can we use a crossdomain.xml from a page that does set the HSTS header?

David, are you aware of any mochitests that test HSTS for plugin subrequests?

Comment 17

[Tanvi Vyas[:tanvi]]

> NPP_URLNotify npp=0x7f7b4b944150,
> url=http://www.youtube.com/crossdomain.xml, reason=2, notifyData=0x1234

Does this mean an actual network request to http://www.youtube.com is made?

Comment 18

[Dana Keeler (she/her) [:keeler]]

(In reply to Tanvi Vyas [:tanvi] from comment #16)
> David, are you aware of any mochitests that test HSTS for plugin subrequests?

I don't think we have any, no.

Comment 19

[Rinat]

(In reply to Tanvi Vyas [:tanvi] from comment #16)
> Instead of youtube.com, can we use a crossdomain.xml from a page that does
> set the HSTS header?

Title page of http://twitter.com could be used. AFAIK, Firefox have pre-enabled
HSTS for twitter.com domain.

Another example is http://www.linux.org.ru . Once you visit https version,
https://www.linux.org.ru, it sets the HSTS flag.

Comment 20

[Kamil Jozwiak [:kjozwiak]]

(In reply to Rinat from comment #19)
> (In reply to Tanvi Vyas [:tanvi] from comment #16)
> > Instead of youtube.com, can we use a crossdomain.xml from a page that does
> > set the HSTS header?
> 
> Title page of http://twitter.com could be used. AFAIK, Firefox have
> pre-enabled
> HSTS for twitter.com domain.
> 
> Another example is http://www.linux.org.ru . Once you visit https version,
> https://www.linux.org.ru, it sets the HSTS flag.

I went through the same test case again, but this time I didn't use the "enforce-encryption" extension to enable/disable the HSTS flag. I used http://twitter.com/crossdomain.xml and http://www.linux.org.ru/ rather then youtube.com as suggested by Rinat in comment # 19. Loading those two URLs in fx will re-direct you to a https:// with HSTS enabled.

twitter using http//: (reason=2)
================================

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_URLRedirectNotify
NPP_SetWindow
NPP_URLNotify npp=0x7f066ba47950, url=http://twitter.com/crossdomain.xml, reason=2, notifyData=0x1234
NPP_Destroy
NP_Shutdown

linux.org.ru using http:// (reason=2)
=====================================

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_URLRedirectNotify
NPP_SetWindow
NPP_URLNotify npp=0x7f1c3c547950, url=http://www.linux.org.ru/, reason=2, notifyData=0x1234
NPP_Destroy
NP_Shutdown

I also tried using https:// which seems to be working:

twitter using https//: (reason=0)
================================

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_NewStream
NPP_WriteReady npp=0x7fcf1b347950, stream=0x7fcf208f4620
NPP_Write npp=0x7fcf1b347950, stream=0x7fcf208f4620, offset=0, len=565, buffer=0x7fcf1b349008
NPP_DestroyStream npp=0x7fcf1b347950, stream=0x7fcf208f4620, reason=0
NPP_URLNotify npp=0x7fcf1b347950, url=https://twitter.com/crossdomain.xml, reason=0, notifyData=0x1234
NPP_SetWindow
NPP_Destroy
NP_Shutdown

linux.org.ru using https:// (reason=0)
=====================================

NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_GetPluginVersion
NP_GetMIMEDescription
NP_GetValue
NP_GetValue
NP_Initialize
NPP_New
  npn.geturlnotify returned 0
NPP_GetValue
NPP_SetWindow
NPP_SetWindow
NPP_GetValue
NPP_SetWindow
NPP_NewStream
NPP_WriteReady npp=0x7f378ec46550, stream=0x7f37941f4620
NPP_Write npp=0x7f378ec46550, stream=0x7f37941f4620, offset=0, len=57771, buffer=0x7f378ec94008
NPP_WriteReady npp=0x7f378ec46550, stream=0x7f37941f4620
NPP_Write npp=0x7f378ec46550, stream=0x7f37941f4620, offset=57771, len=243, buffer=0x7f378ec38008
NPP_DestroyStream npp=0x7f378ec46550, stream=0x7f37941f4620, reason=0
NPP_URLNotify npp=0x7f378ec46550, url=https://www.linux.org.ru/, reason=0, notifyData=0x1234
NPP_Destroy
NP_Shutdown

Comment 21

[Rinat]

NPAPI plugin support was removed from the code base, and is unlikely to return. There is no sense in keeping this bug open anymore.