169289 - No alert for Encrypted/Unencrypted mix and displays both during HTTPS session

Status: VERIFIED DUPLICATE of bug 135007

(Core Graveyard :: Security: UI, defect)

Description

[ramzewe]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:1.0.0) Gecko/20020529
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:1.0.0) Gecko/20020529

Mozilla 1.0 does not alert the user when viewing a page that contains encrypted
and unencrypted data, worse it displays the unencrypted data.

This is contrary to the correct behavior in Netscape 4.x which alerts the user
and does NOT display unencrypted data

Reproducible: Always

Steps to Reproduce:
1.load the following link during an HTTPS session:

<img src="http://images.00mm.net/metrowerks/images/spacer.gif" width="1"
height="1" alt="" border="0"></td>

(often ab-used for web bug email tracking...)
Actual Results:  
1. There WILL NOT be an alert indicating that "You have requested a secure
document that contains some insecure information. The insecure information will
not be shown." And the insecure information WILL be shown.

Expected Results:  
Should produce the above alert and NOT show the insecure information, as would
be the case using Netscape 4.x

Netscape 7.0 using the Gecko engine is also susceptible. See bug #169085

Comment 1

[Greg K.]

ramzewe, are you using the same user profile in both Mozilla and Netscape 7? Please be aware 
that isn't supported and causes some problems. See the release notes for either browser.

Comment 2

[Olivier Cahagne]

*** Bug 177008 has been marked as a duplicate of this bug. ***

Comment 3

[Mitchell Stoltz (not reading bugmail)]

->PSM

Comment 4

[John Unruh]

I believe that the new policy is to allow gif files from http:// sources to be
displayed without a security warning.

Comment 5

[Kai Engert [:KaiE:]]

My understanding is: It is currently not seen as a high priority feature to
check the security feature of images, but it is indeed wanted for a future release.

Comment 6

[Kai Engert [:KaiE:]]

*** This bug has been marked as a duplicate of 135007 ***

Comment 7

[John Unruh]

Verified dupe.