1844978 - https-only exceptions misinterpret attempted wildcards for a domain

Status: RESOLVED FIXED

(Firefox :: Site Permissions, defect, P3)

Description

[Olaf Kock]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0

Steps to reproduce:

• Activate https-only mode
• Open exceptions dialog for https
• Enter a domain, attempt to use a wildcard (even though the online-help asks for exact domain names, e.g. enter "*.neverssl.com"
• Note the error message to enter a valid domain name, but don't give up - try again:
• enter "http://*.neverssl.com"

(note that you won't need an exception for subdomains of neverssl.com for the site to work, but this applies to local domains used in development environments as well)

Actual results:

When entering "http://*.neverssl.com", Firefox lists "http;//http" and "https://http" as exceptions for the https-only mode. E.g. the colon following "http" is likely interpreted as the port number separator, and everything else is ignored. This happens silently, e.g. when there are already exceptions in the list, the user has no visual feedback about the actual value entered.

Expected results:

I'd have expected one of the following (in decreasing order of personal preference)

• wildcards to be accepted, to be able to enter a local development domain, including subdomains, as an exception
• Full URL including "http://" being either rejected, or interpreted correctly (it's not that unusual to enter them, as the protocol will appear in the exceptions list anyway)

Another generally good option would be to either:

• give explicit feedback about the changed values
• display the new exception on top of the list of exceptions: If there are already some exceptions, the unexpected interpretation of the URL goes unnoticed, as it appears at the end of the list. And the existing exceptions make it look like the protocol should be entered as well.

Comment 1

[Daniel Veditz [:dveditz]]

Malte: can you take a look?

Comment 2

[Malte Jürgens [:maltejur]]

I can reproduce this behavior, but as far as I can tell, these dialogs generally don't accept wildcards. For example, the same behavior also happens on the "Cookies and Site Data" exceptions dialog. But I agree that a error would be better here than just accepting some badly parsed input.

Comment 3

[Malte Jürgens [:maltejur]]

Attachment: Bug 1844978 - Discard permission dialog inputs which start with a http(s) scheme and can't be turned into a principal r?#permissions-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/74e7e1c0f01e
Discard permission dialog inputs which start with a http(s) scheme and can't be turned into a principal r=settings-reviewers,Gijs

Comment 5

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/74e7e1c0f01e