1662359 - Failed to download non-https resources in HTTPS-Only Mode

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[nayinain]

Attachment: Capture.webm

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0

Steps to reproduce:

1. Make sure HTTPS-Only Mode is enabled.
2. Open http://forums.mozillazine.org/ and allow permission to use insecure http for this site.
3. Use the context menu save the logo of this site.

Actual results:

Download failed.

Expected results:

It should be downloaded successfully.

---

Sorry for my bad English.

Comment 1

[Tom S [:evilpie]]

Probably a duplicate of bug 1662138.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Ah that might very well be and probably related to both, https-only and blocking mixed content downloads.

Julian, can you investigate this one?

Comment 3

[Julian Gaibler]

Thanks for reporting this nayinain!

That's odd – I'll take a look :)

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

As discussed in our meeting, we should write automated tests for:

• images, and
• pdfs
  for this problem as well.

Comment 5

[Julian Gaibler]

Attachment: Bug 1662359 - Don't upgrade subresources whose triggering principal is exempt from HTTPS-Only mode.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b53895295d3f
Don't upgrade subresources whose triggering principal is exempt from HTTPS-Only mode. r=ckerschb

Comment 7

[Razvan Maries]

Backed out for perma failures.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedTaskRun=MzpainM0TVWXp1Wdmnk01g.0&resultStatus=testfailed%2Cbusted%2Cexception&revision=b53895295d3fd211c387c37c319a2e32151c74c1

Log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=316624444&repo=autoland&lineNumber=3172

Backout: https://hg.mozilla.org/integration/autoland/rev/ec9a5521bf3528a59cfe674389a6be7d7d15b67c

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b884d0736642
Don't upgrade subresources whose triggering principal is exempt from HTTPS-Only mode. r=ckerschb

Comment 9

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/b884d0736642