1484259 - In the new cert error pages it is possible to add a security exception in very small iframes

Status: RESOLVED FIXED

(Firefox :: Security, defect, P1)

Description

[Johann Hofmann [:johannh]]

To mitigate bug 633691, we are not allowing users to add certificate exceptions in iframes. We hide the button here: https://searchfox.org/mozilla-central/rev/246f2b4fab2c1a6cca99418bc2e4d73d1102cc38/browser/base/content/aboutNetError.js#121

Bug 1463759 broke this through an unfortunate collision in CSS styles with this rule: https://searchfox.org/mozilla-central/rev/246f2b4fab2c1a6cca99418bc2e4d73d1102cc38/browser/themes/shared/error-pages.css#52

We should fix that in the 63 cycle, but the harm is currently limited to Nightly since these pages are pref-ed off anywhere else by default.

Comment 1

[:Gijs (he/him)]

[Tracking Requested - why for this release]:
We should make sure we don't ship this.

Comment 2

[Johann Hofmann [:johannh]]

To be precise, this only affects iframe that are smaller in width than 480 pixels.

Comment 3

[Johann Hofmann [:johannh]]

Attachment: Bug 1484259 - Hide the "Add exception" in small iframe error pages. r=nhnt11

This CSS rule was conflicting with the "hidden" property that is being set on the
button when in an iframe. For now I just removed the rule and didn't see any obvious
breakage.

Comment 4

[Johann Hofmann [:johannh]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=de7b2c1fc755a7674d9df77f574e5933b4751afa

Comment 5

[Johann Hofmann [:johannh]]

Attachment: Bug 1484259 - Add is_hidden and is_visible to ContentTaskUtils.jsm. r=nhnt11

This is just a slightly modified copy of the one in BrowserTestUtils.

Comment 6

[Johann Hofmann [:johannh]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=766f8bc9e9f1b8eca70e834264fb2ea329c80d67

Comment 7

[(inactive) Nihanth Subramanya [:nhnt11]]

Comment on attachment 9002749 [details]
Bug 1484259 - Hide the "Add exception" in small iframe error pages. r=nhnt11

Nihanth Subramanya [:nhnt11] has approved the revision.

Comment 8

[(inactive) Nihanth Subramanya [:nhnt11]]

Comment on attachment 9003115 [details]
Bug 1484259 - Add is_hidden and is_visible to ContentTaskUtils.jsm. r=nhnt11

Nihanth Subramanya [:nhnt11] has approved the revision.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2331359b5aec
Hide the "Add exception" in small iframe error pages. r=nhnt11

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d99190a5b731
Add is_hidden and is_visible to ContentTaskUtils.jsm. r=nhnt11

Comment 11

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/2331359b5aec
https://hg.mozilla.org/mozilla-central/rev/d99190a5b731