1540123 - Client certificate selection popup selectbox defective

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[M. van Egmond]

Attachment: ff_cert_bug.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

Firefox 67.0b5:

• Visiting a website that requires a client certificate to connect
• Client certificate popup appears
• Since I have multiple certificates I click the dropdown selectbox.
• The selectbox doesn't open.
• Keyboard arrow keys are used to select a correct certificate

Actual results:

Selectbox doesn't show choices after clicking

Expected results:

Selectbox dropdown opening up and showing all available certificates to choose from.

Comment 1

[Peter Magyari (Desktop QA)]

Hi,

Could you please specify the website you've encountered this issue on?
Also, please test if you can reproduce it using the latest Firefox Nightly, you can find it here: https://www.mozilla.org/en-US/firefox/channel/desktop/

Thank you for reporting!

Comment 3

[M. van Egmond]

(In reply to Peter_M from comment #1)

Hi,

Could you please specify the website you've encountered this issue on?
Also, please test if you can reproduce it using the latest Firefox Nightly, you can find it here: https://www.mozilla.org/en-US/firefox/channel/desktop/

Thank you for reporting!

Hi, the problem is still there with a fresh Nightly installation (68.0a1 (2019-04-02) (64-bit)).

The website I'm trying to visit is https://www.vecozo.nl/Util/login.aspx?ReturnUrl=%2f. However the popup is broken for any website that requires a client certificate for authentication.

Comment 4

[Peter Magyari (Desktop QA)]

Hello,

I will add a component in order to involve the development team in reviewing this issue.

Thank you for your prompt reply!

Comment 5

[:Gijs (he/him)]

Does this also happen on 66 (current release)? Do you know if it happened on earlier betas?

Comment 6

[Miha Psenica]

Hi,
thanks for looking at this.
I am always using developer Edition, mostly the latest version. It was working correctly before, it was broken somewhere in the last two weeks (maybe 2 or 3 Developer editions back it worked properly).
I will install 66 and report if it works correctly.

Comment 7

[:Gijs (he/him)]

Looks like this is a <menulist>, :bgrins, any chance this is a regression from bug 1518932?

Comment 8

[Miha Psenica]

66.0.2 works correctly like intended.

Comment 9

[:Gijs (he/him)]

(In reply to Miha Psenica from comment #8)

66.0.2 works correctly like intended.

Thanks!

Comment 10

[Brian Grinstead [:bgrins]]

Attachment: Bug 1540123 - Append menuitems into the menupopup for the certificate nickname menulist in certificate selection dialog UI

Comment 11

[Brian Grinstead [:bgrins]]

Attachment: Bug 1540123 - Use is/isnot/ok instead of Assert.equal/Assert.notEqual/Assert.ok in browser_clientAuth_ui.js

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/29246127b8eb
Append menuitems into the menupopup for the certificate nickname menulist in certificate selection dialog UI r=keeler
https://hg.mozilla.org/integration/autoland/rev/f7b70caea4a5
Use is/isnot/ok instead of Assert.equal/Assert.notEqual/Assert.ok in browser_clientAuth_ui.js r=keeler

Comment 13

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/29246127b8eb
https://hg.mozilla.org/mozilla-central/rev/f7b70caea4a5

Comment 14

[Pascal Chevrel:pascalc (PTO until April 26)]

Brian, is that a fix that would be safe and valuable to uplift to beta or can it ride the 68 train? Thanks

Comment 15

[Brian Grinstead [:bgrins]]

(In reply to Pascal Chevrel:pascalc from comment #14)

Brian, is that a fix that would be safe and valuable to uplift to beta or can it ride the 68 train? Thanks

Yeah, we should uplift this to beta. I'll do the request.

Comment 16

[Brian Grinstead [:bgrins]]

Comment on attachment 9055244 [details]
Bug 1540123 - Append menuitems into the menupopup for the certificate nickname menulist in certificate selection dialog UI

Beta/Release Uplift Approval Request

• Feature/Bug causing the regression: Bug 1518932
• User impact if declined: Menu for selecting a certificate isn't working
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: TBD - going to ask Dana in the bug
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): When we de-XBLed <menulist>, this changed the position of the menupopup inside of it. With XBL it was always the list.firstChild, but now it isn't so menuitems need to be appended directly into list.menupopup. We updated all callers we knew about in the original patch (Bug 1518932), but missed two of them here.
• String changes made/needed:

Comment 17

[Brian Grinstead [:bgrins]]

Dana, could you give STR for Comment 16? I only ever triggered this UI through the mochitest so I'm not sure what steps to give to QE.

Comment 18

[Pascal Chevrel:pascalc (PTO until April 26)]

FYI, I'll wait for the patch to be verified on nightly to uplift it to beta.

Comment 19

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: certs.tar.gz

• download and untar this file
• import ca.pem using the certificate manager (about:preferences -> search for "certificates" -> view certificates -> authorities -> import (check both trust checkboxes))
• import ee.p12 in the "your certificates" tab of the certificate manager (the password is empty - just hit enter)
• start a server: openssl s_server -cert ee.pem -key ee.key -Verify 1 -www
• navigate to https://localhost:4433

This should cause the client certificate selection dialog to appear.

Comment 20

[Daniel Cicas [:dcicas], Release QA]

Hello,

I can confirm this bug is fixed on Fx 68.0a1 20190407214820. Will leave the qe-verify+ unchanged until I can verify it on Beta as well.

Comment 21

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9055244 [details]
Bug 1540123 - Append menuitems into the menupopup for the certificate nickname menulist in certificate selection dialog UI

Fix for a 67 regression, minimal patch with tests and was verified on Nightly by QA, approved for 67 beta 10, thanks!

Comment 22

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/6a2328c57b79

Comment 23

[Oana Pop-Rus]

https://hg.mozilla.org/releases/mozilla-beta/rev/0b2918cc7338

Comment 24

[Daniel Cicas [:dcicas], Release QA]

Hello,

I verified and can confirm that this issue is fixed on Fx 67.0b10 Windows 10 x64 and Ubuntu 18.04 x64. Also are there other steps to reproduce this bug on macOS (because the openssl s_server -cert ee.pem -key ee.key -Verify 1 -www is not working)?