1364915 - Canceled request via WebExtension still counts as loading mixed content

Status: REOPENED

(WebExtensions :: Request Handling, defect, P5)

Description

[none11given]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36

Steps to reproduce:

Create a WebExtension with the web request blocking permission.

In background.js, subscribe to the onBeforeRequest event and add a listener which will (a) redirect from an HTTP URL to an HTTPS URL, or (b) cancel a request to a HTTP URL.

Load an HTTPS webpage which has an HTTP image on it (mixed content).


Actual results:

The mixed content warning appears in the URL bar.

In the case where we cancel the non-HTTPS request, the image does not load (cannot be seen in the Network tab of the console), but the console still logs the "Loading mixed (insecure) display content" warning and the mixed content icon appears.

In the case where we redirect the non-HTTPS request to HTTPS, the Network tab shows both the HTTP image request and the HTTPS image request, for some reason, but this may just be a quirk of the tool. In any event, the console still logs the mixed content warning, and the mixed content icon appears.


Expected results:

The mixed content warning/icon should not appear, since we intercepted the HTTP request before it happened and never actually loaded any mixed content.

Comment 1

[none11given]

Here are two test pages which serve a non-secure (HTTP) image on an HTTPS page. I'll attach a ZIP with a WebExtension that reproduces the issue on these pages momentarily.

On the first page, the extension will attempt to redirect from HTTP to HTTPS when the image is requested.

https://nonegiven.github.io/mixed1

On the second page, the extension will cancel the request for the image.

https://nonegiven.github.io/mixed2

Comment 2

[none11given]

Attachment: mixed-content-bug.zip

WebExtension which repros the problem on the test pages provided in bug

Comment 3

[none11given]

Attachment: redirect-double-load.PNG

Extension redirects from HTTP to HTTPS; dev tools show image is loaded twice; mixed content warning appears

Comment 4

[none11given]

Attachment: cancel.PNG

Insecure image load is canceled; dev tools show request was never made; mixed content warning appears anyway

Comment 5

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.