1494664 - Add a HSTS carve out for preventing upgrading urls

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Jonathan Kingston [:jkt] he/him]

For the captive portal code to work we load a HTTP url to http://detectportal.firefox.com/success.txt and check if it has been tampered with.

However if firefox.com was on the preload list this would not detect HTTP tampering.

It appears we load the URL in two places:
- As a login page: https://searchfox.org/mozilla-central/rev/ce57be88b8aa2ad03ace1b9684cd6c361be5109f/browser/base/content/browser-captivePortal.js#254
- As a check to the tampering: https://searchfox.org/mozilla-central/rev/ce57be88b8aa2ad03ace1b9684cd6c361be5109f/toolkit/components/captivedetect/captivedetect.js#25

I propose we implement a flag LOAD_BYPASS_HSTS alternatively we could check the URL passed into the LoadInfo and bypass the checks here: https://searchfox.org/mozilla-central/rev/ce57be88b8aa2ad03ace1b9684cd6c361be5109f/netwerk/base/LoadInfo.cpp#199

However we implement this, the tab will have to prevent upgrading of all loads for that document.

Comment 1

[Jonathan Kingston [:jkt] he/him]

Assigning to myself as I think we should get this out of the way quickly.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:ckerschb, could you have a look please?
For more information, please visit auto_nag documentation.