1750195 - Background not displayed on certain test case

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Description

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Attachment: screenshot

Affected versions

• 98.0a1 (20220113215749)
• 97.0b3 (20220113185849)
• 96.0.1 (20220113185450)
• 92.5.0esr (20220105212146)

Affected platforms

• Windows 10x64
• Windows 7x64
• macOS 10.15

Steps to reproduce

1. Open Firefox and https://codepen.io/SoftwareRVGdesignS/pen/OXkOWj.

Expected result

• Background containing the Firefox logo is displayed..

Actual result

• White background is displayed.

Regression range

• Last good revision: fe796758881e69ba7529e528d8f42953da3fcde2
  First bad revision: 11262182f1598e6e87c85299a57df550e8dd537f
  Pushlog:
  https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=fe796758881e69ba7529e528d8f42953da3fcde2&tochange=11262182f1598e6e87c85299a57df550e8dd537f

Notes

• Screenshot attached.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Hey Alexandru, thanks for filing. FWIW, Firefox is not going to do auto upgrading which would fix broken websites that are not using https subresources in https contexts (hence Bug 1703847: Disable Mixed Content Auto-upgrading in Nightly (and in general).

In this particular case the Page CSP blocked the load:
Content Security Policy: Blocking insecure request ‘http://articles-images.sftcdn.net/wp-content/uploads/sites/2/2014/10/firefox-android-header-664x374.png’.

The best way to fix the website is to update the image-request from http: to https:. Please note that Chrome is shipping mixed-content-auto upgrading and therefore this works in Chrome. However, it's a website problem, not a browser problem.

Comment 2

[Alexandru Trif, Desktop Test Engineering [:atrif]]

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #1)

Hey Alexandru, thanks for filing. FWIW, Firefox is not going to do auto upgrading which would fix broken websites that are not using https subresources in https contexts (hence Bug 1703847: Disable Mixed Content Auto-upgrading in Nightly (and in general).

In this particular case the Page CSP blocked the load:
Content Security Policy: Blocking insecure request ‘http://articles-images.sftcdn.net/wp-content/uploads/sites/2/2014/10/firefox-android-header-664x374.png’.

The best way to fix the website is to update the image-request from http: to https:. Please note that Chrome is shipping mixed-content-auto upgrading and therefore this works in Chrome. However, it's a website problem, not a browser problem.

Hello and thank you for the explanation, Christoph. I think it's good to close this as Invalid based on the above.