1582499 - Deal with InsecurePasswordUtils.isFormSecure() for Fission (don't show mixed content warnings on local network pages e.g. routers/intranets)

Status: RESOLVED FIXED

(Toolkit :: Password Manager, task, P2)

Description

[Neil Deakin]

This function determines if the current frame has a local IP address and if the top-level window has a local IP address. If so, the page is considered safe, so mixed content warnings do not appear for those running local network pages and password/form fillin can occur.

With fission enabled, the top-level page cannot be accessed.

Either:

1. Have some state available on the global that indicates that marks the top-level window as a local ip
2. Rewrite code to ask the parent for this information

Comment 1

[Chris Peterson [:cpeterson]]

This bug doesn't look like a Fission blocker if it is just about not showing mixed content warnings for localhost content. If this is a higher priority issue, just let me know!

Comment 2

[Matthew N. [:MattN]]

(In reply to Chris Peterson [:cpeterson] from comment #1)

This bug doesn't look like a Fission blocker if it is just about not showing mixed content warnings for localhost content. If this is a higher priority issue, just let me know!

This bug isn't about localhost, it's about private IP address ranges (10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, 192.168.0.0 to 192.168.255.255, & IPv6 equivalents):

// Ignore insecure documents with URLs that are local IP addresses.
// This is done because the vast majority of routers and other devices
// on the network do not use HTTPS, making this warning show up almost
// constantly on local connections, which annoys users and hurts our cause.

I think this should block the release of Fission to release users given that the above is still a common scenario.

Comment 3

[Chris Peterson [:cpeterson]]

(In reply to Matthew N. [:MattN] (PM me if request are blocking you) from comment #2)

I think this should block the release of Fission to release users given that the above is still a common scenario.

In that case, let's track this bug as a blocker for Fission riding the trains to Beta (Fission M7).

Comment 4

[Neha Kochar [:neha]]

Sam, could you please find an assignee for this Fission M7 bug (target: Fx85-86)?

Comment 5

[Sam Foster [:sfoster] (he/him)]

(In reply to Neha Kochar [:neha] from comment #4)

Sam, could you please find an assignee for this Fission M7 bug (target: Fx85-86)?

Ethan, this should be on your radar I guess.

Comment 6

[Ethan Tseng [:ethan]]

(In reply to Sam Foster [:sfoster] (he/him) from comment #5)

(In reply to Neha Kochar [:neha] from comment #4)

Sam, could you please find an assignee for this Fission M7 bug (target: Fx85-86)?
Ethan, this should be on your radar I guess.

Thanks for the notice. I'll work with my team members to see if we could fix it in time.
Leave the needinfo open for my own reminder.

Comment 7

[Ethan Tseng [:ethan]]

Dimi is taking over this bug. And we are targeting Firefox 86.

Comment 8

[Dimi Lee [:dimi]]

Attachment: Bug 1582499 - P1. Add isLocalIP to WindowContext r=sfoster

When a user clicks a form, the password manager popups a warning when the
form is not in a secure context. However, there is an exception when
a form is in an iframe. When both the url of the iframe and the top-level
are both local ip addresses, we consider it is safe.

This patch adds isLocalIP to WindowContext and WindowGlobalActor.webidl
so password manager can identify whether the top-level url is a local ip
address under fission.

Comment 9

[Dimi Lee [:dimi]]

Attachment: Bug 1582499 - P2. Use WindowContext.isLocalIP in InsecurePasswordUtils.isFormSecure r=sfoster

Depends on D99041

Comment 10

[Dimi Lee [:dimi]]

Attachment: Bug 1582499 - P3. Test insecure warning is not shown when the url of top-level and iframe are both local ip r=sfoster

Depends on D99042

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a16d69b927a9
P1. Add isLocalIP to WindowContext r=nika
https://hg.mozilla.org/integration/autoland/rev/2b4ad8ce76ba
P2. Use WindowContext.isLocalIP in InsecurePasswordUtils.isFormSecure r=sfoster,nika
https://hg.mozilla.org/integration/autoland/rev/9e3d68725565
P3. Test insecure warning is not shown when the url of top-level and iframe are both local ip r=sfoster

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/a16d69b927a9
https://hg.mozilla.org/mozilla-central/rev/2b4ad8ce76ba
https://hg.mozilla.org/mozilla-central/rev/9e3d68725565