1724805 - about:logins avatar display logic is broken

Status: VERIFIED FIXED

(Firefox :: about:logins, defect, P1)

Description

[:Gijs (he/him)]

Noticed via bug 1724718.

There are at least 2 things happening here:

1. https://searchfox.org/mozilla-central/rev/f71cb98fc35da418d2cb9ce31a0416d532dc9d69/browser/components/aboutlogins/content/components/fxaccounts-button.js#50-53 assumes that avatarURL will just exist. The user might not be logged in, or logged in but not verified, and then this is undefined and we add url(undefined) as the variable value, and the browser tries to load chrome://browser/content/aboutlogins/components/undefined which unsurprisingly doesn't work, and also, after the patch from bug 1724718, crashes. I can work around in that bug by just adding an avatar URL to the dummy state object the test uses, but that's not a real fix.
2. the new "initials" avatars aren't loaded because of CSP. The about:logins CSP is <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; img-src data: blob: https://firefoxusercontent.com;">. Note that the data/blob/fx-user-content origins are the only ones allowed for images. But on my main profile (where I checked where the avatar is even supposed to come from), the avatar URL is https://profile.accounts.firefox.com/v1/avatar/g which of course does not match any of those, so it refuses to load it. The good news is that I do see the fallback avatar. Still, it'd be nice if it showed the actual thing.

Comment 1

[Tim Giles [:tgiles]]

Attachment: Bug 1724805 - Fix avatar display logic for FxA on about:logins. r=dimi,sfoster

Fix default avatar not displaying due to avatarURL not existing.

Remove test avatar workaround for test.

Add profile.accounts.firefox.com as part of img-src CSP for about:logins.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0c08810acbee
Fix avatar display logic for FxA on about:logins. r=sfoster

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/0c08810acbee

Comment 4

[Simona Rosu [:srosu], Ecosystem QA]

I have verified this issue using the latest Firefox Nightly 93.0a1 (Build ID: 20210823092315) on Windows 10 x64, Mac 11.5.1, Ubuntu 20.04 x64.

• The “Initials” avatar is displayed on the “about:logins” after signing in to Sync if a profile picture has not been set on the FxA account.