150863 - Incorrect display of broken security with low/high crypto mix

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Kai Engert (:KaiE:)]

Go to a https web page that loads content from two servers, some from a server
with high security and some from a server with low security.

Actual behaviour: Mozilla will report the website is using unencrypted content
and will set the broken lock icon.

Expected behaviour: Mozilla should report a "low crypto" warning, and show a
secure lock icon.

Comment 1

[Kai Engert (:KaiE:)]

I want to provide a test case, but I don't know a public accessible https server
with low security - therefore I'm referencing an inhouse server.

Go to:
  https://www.kuix.de/misc/test19/mixed_strengh.html

The left frame will be low security, the right frame high security.

Comment 2

[Kai Engert (:KaiE:)]

Attachment: Suggested Fix

Comment 3

[Kai Engert (:KaiE:)]

Javi, can you please review?

Comment 4

[Javier Delgadillo]

Comment on attachment 87213 [details] [diff] [review]
Suggested Fix

r=javi

Comment 5

[Kai Engert (:KaiE:)]

Alec, can you please sr=?

Comment 6

[John Unruh]

I've added an in-house test URL above - https://pki.mcom.com/hilo.html

Comment 7

[Alec Flett]

Comment on attachment 87213 [details] [diff] [review]
Suggested Fix

sr=alecf

Comment 8

[Kai Engert (:KaiE:)]

Checked in to trunk.

Comment 9

[John Unruh]

Marking fixed on 6/14 trunk.

Comment 10

[John Unruh]

Verified on trunk. 

Comment 11

[Jaime Rodriguez, Jr.]

adt1.0.1+ (on ADT's behalf) approval for checkin to the 1.0 branch, pending
Drivers' approval. pls check this in asap, then add the "fixed1.0.1" keyword.
thanks!

Comment 12

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 13

[Kai Engert (:KaiE:)]

Checked in to 1_0 branch.

Comment 14

[John Unruh]

Verified on 6/20 branch.