1258549 - Fennec prefs contain insecure links for about: pages

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Daniel Veditz [:dveditz]]

+++ This bug was initially created as a clone of Bug #1257744 +++

Firefox for Android has several insecure (http:) links in its pref file

app.support.baseURL
http://support.mozilla.org/1/mobile/%VERSION%/%OS%/%LOCALE%/

app.creditsURL
http://www.mozilla.org/credits/

app.channelURL
http://www.mozilla.org/%LOCALE%/firefox/channel/

app.releaseNotesURL
http://www.mozilla.com/%LOCALE%/mobile/%VERSION%/auroranotes/
http://www.mozilla.com/%LOCALE%/mobile/%VERSION%beta/releasenotes/
http://www.mozilla.com/%LOCALE%/mobile/%VERSION%/releasenotes/

All of those resources can be loaded securely by changing http: to https:

The B2GDroid default prefs have a copy of these plus the addition pref

app.faqURL
http://www.mozilla.com/%LOCALE%/mobile/beta/faq/
http://www.mozilla.com/%LOCALE%/mobile/faq/

Comment 1

[:Margaret Leibovic]

ahunt, do you want to write a quick patch for this? I haven't had time to get to this myself.

Comment 2

[Andrzej Hunt :ahunt]

All our licence headers contain a link to http://mozilla.org/MPL/2.0/ - upgrading that to https would make it easier to grep for this sort of thing, but might be noisy - is it worth doing that too?

Comment 3

[Andrzej Hunt :ahunt]

Attachment: Upgrade fennec support links

Comment 4

[Andrzej Hunt :ahunt]

Attachment: Update b2g support links

Comment 5

[:Margaret Leibovic]

Comment on attachment 8759768 [details] [diff] [review]
Upgrade fennec support links

Review of attachment 8759768 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks.

Comment 6

[:Margaret Leibovic]

Comment on attachment 8759772 [details] [diff] [review]
Update b2g support links

Review of attachment 8759772 [details] [diff] [review]:
-----------------------------------------------------------------

Not sure if this is even used anymore, but hey, why not.

Comment 7

[:Margaret Leibovic]

(In reply to Andrzej Hunt :ahunt from comment #2)
> All our licence headers contain a link to http://mozilla.org/MPL/2.0/ -
> upgrading that to https would make it easier to grep for this sort of thing,
> but might be noisy - is it worth doing that too?

Hm, that seems like something that should updated in the boilerplate as well in that case.

Could be worth filing another (non-security) bug about this, and you could ask gerv what he thinks.

Comment 8

[Andrzej Hunt :ahunt]

https://hg.mozilla.org/integration/fx-team/rev/41115c9571f20cf168e85315c359a8ab40365a69
Bug 1258549 - Upgrade fennec support links r=margaret

https://hg.mozilla.org/integration/fx-team/rev/2bcd6f6c4cac57b9bf7d0df2ce6f944ff2519628
Bug 1258549 - Upgrade b2g support links r=margaret

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/41115c9571f2
https://hg.mozilla.org/mozilla-central/rev/2bcd6f6c4cac

Comment 10

[:Margaret Leibovic]

Should we uplift this? Seems low risk.

Comment 11

[Andrzej Hunt :ahunt]

Comment on attachment 8759768 [details] [diff] [review]
Upgrade fennec support links

Approval Request Comment
[Feature/regressing bug #]: n/a
[User impact if declined]: Support links use http / will be loaded insecurely. (Based on my incomplete knowledge this means they could be intercepted/spoofed/etc, I don't have access to the original bug.)
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: low risk: support links updated to https from http.
[String/UUID change made/needed]: none.

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8759768 [details] [diff] [review]
Upgrade fennec support links

Low risk, fix a sec-low issue, taking it.
Should be in 48 beta 4

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/af923f4926e7
https://hg.mozilla.org/releases/mozilla-beta/rev/2091f8c1a940

Comment 14

[u421692]

Verified as fixed on Firefox 48 Beta 4, all the links are upgraded to https

Comment 15

[u421692]

Verified on latest Aurora and Nightly build, all the links are upgraded to https.