1997064 - Unified trust panel shows Not Secure label on about:url-classifier

Status: NEW

(Firefox :: Site Identity, defect, P2)

Description

[Moritz Beier [:mbeier]]

Attachment: example

With the unified trust panel enabled, there is a Not Secure label in the urlbar on about:url-classifier even though it's an about: site.

Comment 1

[Daniel Veditz [:dveditz]]

In fact, it's most about: URLs. I haven't looked at the trust panel code but it looks like the about pages with the nsIAboutModule::IS_SECURE_CHROME_UI flag get the "Firefox" (or Nightly) identity block, and all the rest are shown as "Not Secure". You can start with about:about (not secure) and load a bunch from there:
about:logo
about:memory
about:mozilla
about:networking
about:privatebrowsing (if you try to open as a tab in a non-private window)
about:robots
about:serviceworkers
about:unloads
about:glean
about:logging
... etc.

There are a few about: urls where we clear the address bar, and whether we show "Not Secure" depends on how you got there or how you change it. If you navigate a tab to "about:blank" we show that text and "Not Secure". If you open an "about:blank" popup then we show a blank addressbar and the search icon. If the opener then writes into that window we show "Not Secure" and "about:blank" (I thought we changed this to show the origin, which is now set to what the opener is?).

Comment 2

[Daniel Veditz [:dveditz]]

There are a few you could argue "Not Secure" isn't exactly wrong, like about:blocking and about:certerror, and maybe some of the trust panel bits are relevant (clear cookies and such are for the site you tried to load). But for the rest of the about: urls the trust panel makes no sense.

Comment 3

[Daniel Veditz [:dveditz]]

When the unified trust panel is disabled, the affected about: pages get the generic document icon like a file:/// URL. When clicked the site information panel says "This page is stored on your computer" like it does for a file:/// URL, too.