1812313 - Entering http URL in ETP exceptions under preferences will be displayed as https

Status: NEW

(Firefox :: Settings UI, defect, P5)

Description

[jk-85]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0

Steps to reproduce:

Extras->Einstellungen->Verbesserter Schutz vor Aktivitätenverfolgung->Ausnahmen verwalten.

Actual results:

I entered a http-URL in firefox (google) safe-browsing list, but every URL I put in there will be translatet to https-link and this links will not work as whitelist-links.

Expected results:

Every URL should be inserted as I input them (http as http, https as https).

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Settings UI' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Note the set of steps in English is: Tools->Settings->Enhanced Tracking Protection->Manage Exceptions

Comment 3

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

:pbz, did you happen to work on this? was this a design choice or is this a bug?

Comment 4

[Emma Zühlcke [:emz]]

Hannah made some changes in that UI recently. Forwarding the NI. Thanks!

Comment 5

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Managed to reproduce on:

• Firefox 109.0;
• Firefox 110.0b6;
• Nightly 111.0a1;

Tested on:

• macOS 12;
• Windows 10;
• Ubuntu 22;

Setting as NEW.

Comment 6

[Hannah Peuckmann]

This was a design choice. If you go to any http site and add an ETP exception via the shield icon you can then see in about:preferences#privacy -> Enhanced Tracking Protection -> Manage exceptions that an https entry was made. So when we added the possibility for users to add ETP exceptions via manage exceptions we sticked to the behavior of the shield icon.

Comment 7

[Emma Zühlcke [:emz]]

Thanks! ETP exceptions apply for both the HTTP and the HTTPS variant of a site. So even if you only see the HTTPS variant of an entry it will also apply to HTTP.
I can see how it's a bit confusing though, we could improve this by either omitting the scheme or adding entries of both types. When adding both entries the removal action would have to cover both schemes.

Comment 8

[jk-85]

I want to insert this page, it cuts the .jpg-part, makes https from it, but after I reload it or restart firefox, I still see the red warning.

Comment 9

[jk-85]

Oops, forgot the URL: http://sosrff.tsu.ru/new/shm.jpg

Comment 10

[jk-85]

Surely not the "jpg"-part, but it cuts the "http:"-part.

Comment 11

[Emma Zühlcke [:emz]]

ETP exceptions are keyed per origin. If you Add for example http://sosrff.tsu.ru/new/shm.jpg you exception will be applied to all paths under http://sosrff.tsu.ru and https://sosrff.tsu.ru.

Comment 12

[Emma Zühlcke [:emz]]

Oh, I just realized what you mean by red warning. That's the safe browsing warning which is not related to ETP. Adding an ETP exception does not prevent this warning from showing. Safebrowsing can be disabled too but it is not recommended.

Comment 13

[jk-85]

Ah, that explains it. So a Google safe-browsing whitelist that a user can easily manage himself (without the about:config..... and other stuff) is not available at the moment? Thanks!

Comment 14

[Emma Zühlcke [:emz]]

We don't recommend visiting sites on this list as they can be dangerous, for example distributing malware. You can read more about the protection here: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work?as=u&utm_source=inproduct
I don't think there is a way to opt-out per site. You can only disable the mechanism altogether, which again is not recommended.

I would still like to keep this bug open for the confusing user experience in the ETP exception settings where https gets added even though the url added is an http url.

Comment 15

[jk-85]

OK, thank you. That's a site I visit for many years now and suddenly it landed on a black-list. There's a 2nd URL I visit often on this server and it didn't blacklist. So the google blacklist is weird for this kind of site. http://sosrff.tsu.ru/?page_id=12 (is ok). http://sosrff.tsu.ru/new/shm.jpg (is not ok). That's only scientific data, nothing more.

Comment 16

[Emma Zühlcke [:emz]]

I can't speak to whether the site is safe or not. However there is a form to report incorrect warnings: https://safebrowsing.google.com/safebrowsing/report_error/?hl=en

Comment 17

[jk-85]

Thanks, I filled that out!