1714582 - [Bug] After clicking on "Accept the Risk and Continue" in the notification "Secure Connection Failed", Firefox for Android marks untrusted by any reason HTTPS site connection as secure

Status: VERIFIED FIXED

(GeckoView :: General, defect, P1)

Description

[Petru-Mugurel Lingurar [:petru]]

From github: https://github.com/mozilla-mobile/fenix/issues/19799.

Steps to reproduce

1. Open any untrusted site with HTTPS connection using Firefox for Mobile (for example, badssl.com).
2. Skip notification "Secure Connection Failed" by clicking on "Accept the Risk and Continue"
3. Look at the security icon and status

Expected behavior

Firefox for Android defines connection as unsecure even with security exception, like Firefox for Desktop

Actual behavior

Firefox for Android defines connection and site's certificate as fully secure and misleads the user

Device information

• Device vendor / model and Android version: Samsung Galaxy A20s (ARM64) with Android 10, Samsung Galaxy J2 Prime (ARMv7) with Android 6.0.1
• Firefox for Android version: 89.1.1, 90.0.0-beta.1

Screenshots

(how it looks at Samsung Galaxy A20s)

(how it looks at Samsung Galaxy J2 Prime)

Video

https://user-images.githubusercontent.com/85299944/120673075-87aa6c00-c49b-11eb-9367-89233e267de8.mp4

Change performed by the Move to Bugzilla add-on.

Comment 1

[Petru-Mugurel Lingurar [:petru]]

Following these steps I see this sending to AndroidComponents here that "securityInfo.isSecure == true" hence the app showing that session as being secure.

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Bug 1714582: Ensure that cert error overrides do not mistakenly flag a connection as secure; r=#geckoview-reviewers

Two issues:

1. We were missing the originAttributes argument to nsICertOverrideService.hasMatchingOverride.
2. If the override does exist, we should flagging it as insecure.

I also enhanced a test to check this.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bdd3b02b105a
Ensure that cert error overrides do not mistakenly flag a connection as secure; r=geckoview-reviewers,owlish

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/bdd3b02b105a

Comment 5

[Mihai Adrian Carare [:mcarare]]

This is still reproducible for private sessions. In both Focus and Firefox private mode.

Comment 6

[Adina Petridean QA [:apetridean]]

Attachment: untrusted1.png

Verified as fixed on the latest Nightly 109.0a1 from 22/11 with Sony Xperia (Android 6.0.1). Firefox for Android defines connection as unsecure in normal and private browsing.