1335083 - HSTS Priming can cause content load failures (endless loop) due to mixed content blocked

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect, P1)

Description

[Matthias Magdeburg]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131

Steps to reproduce:

-after update to version 51.0.1 Firefox is in a loading-loop and content will not be loaded


Actual results:

Some users pointed out to me that my website was not available. Test with all other browsers and older versions of the Firefox ran however positive, so the error occurs only with Firefox version 51.0.1 (32 bit). After server side problems could be excluded, the website was liberated bit by bit from HTML code. The call worked when removing the following line of code. In the code is a link which returns a 404.

<script src="http://ajax.googleapis.com/ajax/libs/jGquery/1.8.3/jquery.min.js"></script>

The false script link to jquery at googleapis.com (404) was the reason.

If the page was accessed via a subpage by Google and then entered the damaged homepage, everything went perfectly and the site could be called directly without modification by domain. However, if the loop was cleared again, the endless loop was there again.

Comment 1

[Loic]

If it's specific to a unique website, could you provide the URL, please.

In addition, does it work with a fresh profile?
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles

Comment 2

[Matthias Magdeburg]

I reproduce the problem in this URL:

https://pswgmbh-lsa.de/index.php?article_id=36

The sourcecode is the same like the sourcecode at the startpage on https://pswgmbh-lsa.de - only the named line of code (there is a false link in this line - look at JGquery) and the firefox goes to endless loop.

Also to reproduce the loop, you need an empty cache. 


On https://webkartell.de/test.html i put an empty html-site only with the false line of code, the problem is the same...

Comment 3

[Loic]

With https://pswgmbh-lsa.de/index.php?article_id=36 I see 2 errors about mixed content blocked because font and jquery are served from CDN googleapis.com without HTTPS.

Same observation with https://webkartell.de/test.html

Comment 4

[Loic]

Regression:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8387a4ada9a5c4cab059d8fafe0f8c933e83c149&tochange=15b774db7eab7fc4c9489db9c9f77a2e73536e22

It's due to bug 1313595 but it should be fixed by bug 1335224 which has disabled HSTS priming in FF51.

Comment 5

[Loic]

This is weird, on my current profile with FF51, the website doesn't load with security.mixed_content.send_hsts_priming=false, I need to set it to true.

On another profile, it works normally, with security.mixed_content.send_hsts_priming=false.

Comment 6

[Matthias Magdeburg]

Yes it's weird, cause the website runs all time without problems, after the update there is the bug/loop.

But it is nice you found the problem. I publishes the same code of the test.html with an https: link which is false, after your comment and firefox  doesn't have the problem.

Look at https://webkartell.de/test_ssl.html

Comment 7

[Loic]

[Tracking Requested - why for this release]:

Comment 8

[Kate McKinley [:kmckinley, :Kate]]

I am unable to reproduce this with security.mixed_content.send_hsts_priming set to false, with a new/clean profile or an existing profile.

Comment 9

[Loic]

Yes, it's because my current profile has the option "Check for updates, but let me choose whether to install them" enabled instead of "Automatically install updates" which blocks the update of bugfixes by addon system. Which is a real bad design IMHO.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

This is fixed on Beta/Release by the changing of the pref, but we should probably leave this bug open for tracking before HSTS priming tries to ride the trains.

Comment 11

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

[Tracking Requested - why for this release]: Regression

+ fixing statuses (Fx 53 is affected - bug #1335224 and bug #1335134)

Comment 12

[Marcia Knous [:marcia]]

Tracking 53/54+ for this regression.

Comment 13

[Nathan Froyd [:froydnj]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #10)
> This is fixed on Beta/Release by the changing of the pref, but we should
> probably leave this bug open for tracking before HSTS priming tries to ride
> the trains.

Is HSTS priming riding the train for 54, then, Christoph?  Can we make this bug block/depend on whatever bug is turning on HSTS priming?

Comment 14

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Nathan Froyd [:froydnj] from comment #13)
> (In reply to Ryan VanderMeulen [:RyanVM] from comment #10)
> > This is fixed on Beta/Release by the changing of the pref, but we should
> > probably leave this bug open for tracking before HSTS priming tries to ride
> > the trains.
> 
> Is HSTS priming riding the train for 54, then, Christoph?  Can we make this
> bug block/depend on whatever bug is turning on HSTS priming?

Redirecting this one to Kate.

Comment 15

[Kate McKinley [:kmckinley, :Kate]]

I'm unable to reproduce this issue. I left it open in case someone could reproduce it.

Matthias, are you able to reproduce this issue currently with Release, or any other current version of Firefox?

Comment 16

[J.C. Jones [:jcj] (he/they)]

As we're not hearing back from the reporter, I'm clearing the needinfo. Kate, let's meet with QA and see what we can come up with to try other ways to reproduce.

Comment 17

[Liz Henry (:lizzard) (relman/hg->git project)]

Sounds reasonable to resolved this as WORKSFOR ME since we haven't been able to reproduce the issue in 52 or higher. 

If anyone does manage to reproduce it, please n-i to jcj or kate and reopen the bug with all the details.