1563431 - Add flag for HTTP site with password field to SecurityInformation

Status: NEW

(GeckoView :: General, defect, P3)

Description

[Tiger Oakes]

User Agent: Mozilla/5.0 (X11; CrOS x86_64 12239.19.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.38 Safari/537.36

Steps to reproduce:

Open a HTTP website with a password field like http://http-password.badssl.com/

Actual results:

In the toolbar, a standard globe icon will be shown, because the component doesn't know a password field is on the page.

Expected results:

A broken padlock should be shown instead. To support this, we need some flag on GeckoSession.ProgressDelegate.SecurityInformation to see if a page is HTTP and has a password field. This matches desktop Firefox behaviour.

Comment 1

[Chris Peterson [:cpeterson]]

Fennec has the same bad behavior.

Comment 2

[Madis]

Fenix still needs a flag to mark all HTTP insecure as well, as that will be the default in desktop Firefox soon - bug 1562881 (see D37790).

Comment 3

[BugBot [:suhaib / :marco]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 4

[Charlotte Wilson [:cswilson252]]

Attachment: Bug 1563431 - Add password field checker to ProgressDelegate r=#geckoview-reviewers!

Comment 5

[Charlotte Wilson [:cswilson252]]

Attachment: WIP: Bug 1563431 - Check if password field is present on sites with active mixed content r=android-reviewers!

Comment 6

[Makoto Kato [:m_kato]]

Tracker.onSecurityChange is on network layer, so it doesn't know whether web content has password field. SecurityInformation won't be good way for this.