186695 - [FIX]FTP/HTTP password printed as part of URL

Status: RESOLVED FIXED

(Core :: Printing: Output, defect, P1)

Description

[Alon Altman]

When a password-protected FTP or HTTP resource is accessed via
ftp://user:password@host/ method, and then printed, the password is printed as
part of the URL. This creates a security risk, as the user does not notice that
his or her password is printed along with the page, and may share or submit the
hardcopy (with the password) to an untrusted third party.

Steps to reproduce:
1. Go to a ftp://user:password@host/dir/file URL.
2. Print the file (or do a print preview).
3. See the password in the printed page.

Expected results:
  Password is masked or removed entirely.

Actual results:
  Secret password revealed in printed material.

Comment 1

[Simon Montagu :smontagu]

Bug 88771 and bug 130327 are related.

Comment 2

[Kevin McCluskey (gone)]

nsbeta1+

-> jkeiser

Comment 3

[Alon Altman]

Can someone point me to the code which deals with putting the URL on the printed
page?

Comment 4

[Mike Coppins]

Confirming in 1.4.1/1.5 release versions / win32.

Comment 5

[Thomas Kerpe]

This bug seems still be present in Mozilla Firefox 1.0 Win

Comment 6

[:Gavin Sharp [email: [e-mail]]]

My guess is that the code that would need to be changed lies in:

http://lxr.mozilla.org/mozilla/source/layout/printing/nsPrintEngine.cpp#2077

Comment 7

[Frank Wein [:mcsmurf]]

*** Bug 278513 has been marked as a duplicate of this bug. ***

Comment 8

[Doug Wright]

Bug 280438 is similar and is blocking aviary1.1

Comment 9

[Jungshik Shin]

(In reply to comment #6)

> http://lxr.mozilla.org/mozilla/source/layout/printing/nsPrintEngine.cpp#2077

Alternatively, we can fix two implementations of them. Are ftp and http(s) the
only schemes we have to worry about? 

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

too late for 1.8b1, but we should get this for 1.8b2.

Comment 11

[Grayson Mixon (ColdFusion650)]

it seems that there are 3 situations. if u put the username and password in the
address bar, the username and password shows up at the top of the printed page.
if u only put the username in the address bar and fill in the alert box with ur
password, only ur username appears on the printed page. if u put neither in the
address bar and fill in the alert box with both, neither appear at the top of
the printed page.

so its not putting ur username and password at the top.. per se. its just
putting whatever u put in the address bar. temporary fix, dont put ur username
and password in the address bar. just fill in the alert box.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Attachment: Simple fix

Comment 13

[Johnny Stenback (:jst)]

Comment on attachment 177401 [details] [diff] [review]
Simple fix

r=jst

Comment 14

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 15

[:Gavin Sharp [email: [e-mail]]]

*** Bug 292876 has been marked as a duplicate of this bug. ***