1431192 - Firefox fetches safe browsing information even if Deceptive Content and Dangerous Software Protection is off

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect, P1)

Description

[Eduardo Trápani]

To reproduce:

- download nightly and run it on a clean profile

- run it and check the browser console, where the fetching of the safe browsing information from Google happens[1]. That is normal.

- go to preferences and disable Deceptive Content and Dangerous Software Protection. The ones below will be greyed out.

- set browser.safebrowsing.provider.google4.nextupdatetime to "1"

- quit

- start the browser and check the console. Now, even though browser.safebrowsing.malware.enabled and browser.safebrowsing.phishing.enabled are false, Firefox still fetches the resource[1]


Expected behaviour:

If "Deceptive Content and Dangerous Software Protection" is off, then there should be no network connection to the providers of those services.

[1] https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch ...

Comment 1

[Panos Astithas (he/him) [:past] (please ni?)]

Hey Johann, I wanted to make sure someone in seceng looks at this while Francois is out.

Comment 2

[Johann Hofmann [:johannh]]

Thanks!

So, uh, François is the expert on SafeBrowsing, but after a quick check it seems to me like setting browser.safebrowsing.provider.google4.nextupdatetime to 1 is intentionally forcing a table refresh, and we generally don't support users meddling with their about:config.

Eduardo, can you confirm that without going into about:config, the request to SafeBrowsing is not made?

Comment 3

[Eduardo Trápani]

Yes, I just confirmed it. A day later, without any changes (and Deceptive Content and Dangerous Software Protection off) I started Firefox and it refreshed the resource.

Once I spotted this, I wanted a quick way to reproduce it for this report, that's why I set it to 1. Actually, it might be clearer to set

browser.safebrowsing.provider.google.nextupdatetime = browser.safebrowsing.provider.google.lastupdatetime + x

It feels less hackish, but the result is the same.

Comment 4

[François Marier [:francois]]

I think that this regression was introduced in bug 1388574.

Eduardo, can you please try the following:

1. Leave "Block dangerous and deceptive content" enabled.
2. Uncheck "Block dangerous downloads".
3. Uncheck "Block dangerous and deceptive content".
4. Set browser.safebrowsing.provider.google4.nextupdatetime=1

Then restart Firefox and see if it still connects to the Google Safe Browsing server.

Comment 5

[Eduardo Trápani]

> Eduardo, can you please try the following:
> 
> 1. Leave "Block dangerous and deceptive content" enabled.
> 2. Uncheck "Block dangerous downloads".
> 3. Uncheck "Block dangerous and deceptive content".
> 4. Set browser.safebrowsing.provider.google4.nextupdatetime=1
> 
> Then restart Firefox and see if it still connects to the Google Safe
> Browsing server.

If I follow those steps, Firefox no longer connects to the Google Safe Browsing server.

Comment 6

[François Marier [:francois]]

Attachment: Bug 1431192 - Only fetch download protection lists when Safe Browsing is enabled.

Download protection requires both the malware list as well as its
own special lists. The code therefore checks that both Safe
Browsing and download protection are enabled before checking
downloaded files.

The list manager should check the same prefs before downloading
any of the download protection lists in order to avoid connecting
to the Safe Browsing server when Safe Browsing is fully disabled.

Review commit: https://reviewboard.mozilla.org/r/216422/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/216422/

Comment 7

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8946491 [details]
Bug 1431192 - Only fetch download protection lists when Safe Browsing is enabled.

https://reviewboard.mozilla.org/r/216422/#review222774

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79905d4e85ab
Only fetch download protection lists when Safe Browsing is enabled. r=gcp

Comment 9

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/79905d4e85ab

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Please request Beta approval on this when you get a chance. It grafts cleanly as-landed.

Comment 11

[François Marier [:francois]]

Comment on attachment 8946491 [details]
Bug 1431192 - Only fetch download protection lists when Safe Browsing is enabled.

Approval Request Comment
[Feature/Bug causing the regression]: 1388574
[User impact if declined]: Google servers pinged even when Safe Browsing is disabled.
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: Yes, manually.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No.
[Why is the change risky/not risky?]: It's very small.
[String changes made/needed]: None

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8946491 [details]
Bug 1431192 - Only fetch download protection lists when Safe Browsing is enabled.

Simple patch and fixes a privacy issue. Let's get this in 59b7.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/7cefe9877e46