139884 - SRC="//blah" doesn't work in secure mode

Status: VERIFIED WORKSFORME

(Core :: Networking: HTTP, defect)

Description

[ken anderson]

script used by geotrust SSL certs for popup image doesn't work in secure mode
with RC1. 

<SCRIPT LANGUAGE="JavaScript" TYPE="text/javascript"
SRC="//smarticon.geotrust.com/si.js"></SCRIPT>


http://www.sylvanborderfarm.com/order.shtml (icon shows)
https://www.sylvanborderfarm.com/order.shtml (icon doesn't show)

Comment 1

[Phil Schwartau]

Browser, not engine ---> Browser-General until we can get further info.

I don't understand when the popup is supposed to come up: 
on load? On some user action? I don't get any popups
when I load either URL.

Also: what build ID of Mozilla are you using? Please include this
in any bug report - thanks.

Comment 2

[ken anderson]

I'm using Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.0rc1) Gecko/20020417
The image at the bottom of the page doesn't display using https.
Clicking on the image generates the popup. Sorry for the confusion.
Ken

Comment 3

[Boris Zbarsky [:bzbarsky]]

to http networking...  Seeing this on Linux too.

Comment 4

[Darin Fisher]

mass futuring of untargeted bugs

Comment 5

[benc]

What is this URL supposed to really mean? 

I think it is invalid, it should fail in all contexts.

Comment 6

[Andreas Otte]

This is some kind of relative url which only takes the scheme from the base url
and the rest from the "relative" url. We support this since M10 or something
like that. Why it is failing with https is beyond me, since the url resolver
does not know anything about the scheme, I don't think this has anything to do
with the urlparser.

Comment 7

[Darin Fisher]

WFM win2k 2003031504.

Comment 8

[benc]

VERIFIED/WFM: sort of

I don't know where this popup should occur, because I tried both URLs in Mozilla
1.3f and IE on Mac OS X.

Here's my final question for andreas:

What URL would that expand to?

http://www.sylvanborderfarm.com//smarticon.geotrust.com/si.js ?

I think the author intended to put:

SRC="http://smarticon.geotrust.com/si.js", because that is a real page that loads.

I did a proxy log trace of loading the http: page, and logged the follow activity:

"GET http://www.sylvanborderfarm.com/order.shtml HTTP/1.1"

"GET http://smarticon.geotrust.com/si.js HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/boob1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/aboutus1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/health1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/glutenfree-txt.jpg HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/products1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/howtobuy1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/recipes1.gif HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/tips1.gif HTTP/1.1"
"GET
http://smarticon.geotrust.com/smarticon?ctr=1048088798390&ref=www.sylvanborderfarm.com
HTTP/1.1"
"GET http://www.sylvanborderfarm.com/images/order-bymail-button.jpg HTTP/1.1" 
"GET
http://smarticon.geotrust.com/smarticon?ctr=1048088849134&ref=www.sylvanborderfarm.com
HTTP/1.1"

What really baffles me is that when I save the file to disk there is a "si" file
in the subfolder, which has the correct js code, but my proxy doesn't have a GET
associated w/ the page load (I did load it on the side via the proxy while
analyzing the problem).