1465847 - WebsiteFilter policy does not block view-source

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, defect, P3)

Description

[:Felipe Gomes (needinfo for replies!)]

+++ This bug was initially created as a clone of Bug #1429178 +++

As reported in bug 1429178 comment 27, right-clicking on the Blocked Page when the WebsiteFilter policy is in use will still allow the view source protocol from downloading the page and displaying its source

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1465847 - If a website is blocked via policy, block view source. r?emalysz!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d1c5493f3915
If a website is blocked via policy, block view source. r=emalysz

Comment 3

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f49306f697f
Backed out changeset d1c5493f3915 for causing leaks CLOSED TREE

Comment 4

[Bogdan Tara[:bogdan_tara | bogdant]]

Backed out changeset d1c5493f3915 (bug 1465847) for causing leaks.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&searchStr=mochitests&tochange=0f49306f697fb1a6c579e5ab433bff573dd01d49&fromchange=7d86a83672c5a74ae17f5f9141babb1c25293a89&selectedTaskRun=Cu3Ej52nQuqkwaBg_UYbsw.1

Backout link: https://hg.mozilla.org/integration/autoland/rev/0f49306f697fb1a6c579e5ab433bff573dd01d49

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=319571640&repo=autoland&lineNumber=5421

Comment 5

[Mike Kaply [:mkaply]]

I'm still looking at how to resolve this.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0c472d4d9215
If a website is blocked via policy, block view source. r=emalysz

Comment 7

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/0c472d4d9215

Comment 8

[Mike Kaply [:mkaply]]

Comment on attachment 9183020 [details]
Bug 1465847 - If a website is blocked via policy, block view source. r?emalysz!

Beta/Release Uplift Approval Request

• User impact if declined: Even though URLs and files are blocked, users can still view-source those URLs.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only, only affects if view source is active.
• String changes made/needed:

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Fixes a small hole in our file blocking. I apologize for not getting this into the last release. The test was causing a leak which we are investigating separately (it was unrelated to this fix). Very low risk.
• User impact if declined: Even though URLs and files are blocked, users can still view-source those URLs.
• Fix Landed on Version: 85
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only, only affects if view source is active.
• String or UUID changes made by this patch:

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9183020 [details]
Bug 1465847 - If a website is blocked via policy, block view source. r?emalysz!

Approved for 84.0b4.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/4d1ac69823b0

Comment 11

[Julien Cristau [:jcristau]]

Comment on attachment 9183020 [details]
Bug 1465847 - If a website is blocked via policy, block view source. r?emalysz!

approved for 78.6esr

Comment 12

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/53f4fae320e1