307027 - Going back from secure page to error page does not clear yellow bar

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[Zarco Zwier]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050901 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050901 Firefox/1.6a1

-

Reproducible: Always

Steps to Reproduce:
1. Enter location: bla://bla.com (show error)
2. Enter location: j<>avascript (go's to
https://lists.latech.edu/pipermail/javascript/2002-May/003519.html)
3. Click on Back button

Actual Results:  
Location bar stays yellow.
The yellow locks indicate that the page is still at the previous domain

Expected Results:  
Clear the location

Comment 1

[Kevin Brosnan]

WFM - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050903
Firefox/1.0+

Comment 2

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20050903 Firefox/1.6a1

I can confirm this. The same thing happens when you visit a page that has an RSS
feed with the "I'm Feeling Lucky" search -- you end up seeing the RSS icon when
you go back to the error page.

Comment 3

[Daniel Veditz [:dveditz]]

Note comment 0 and 2 appear to be trunk, comment 1 is branch. A trunk-only
regression? No, I can confirm on the branch: 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050902
Firefox/1.0+

"I'm feeling lucky" seems to have nothing to do with it. I can go to any secure
page (e.g. bugzilla) and find that the secure state is not cleared when I go
back to the error page. Nominating for next beta, I don't think this needs to
hold up the one we're about to release.

I do not see this with the more commen "Server not found" error page, but do
with the "address wasn't understood" (bad scheme) error page. I guess we'll have
to test each error type.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

It also happens in the other direction. Loading a b.m.o page then trying to
visit bla://dummy.com will result in the error page displayed with Bugzilla's
security info displayed and the yellow location bar. Tested using a 20050903 1.8
branch build.

Comment 5

[Asa Dotzler [:asa]]

->mconnor

Comment 6

[Mike Connor [:mconnor]]

ok, so this only breaks in the the unknown protocol case, as far as I understand
it.  For this error, we don't fire any of the state change notifications
properly (the firefox RSS icon doesn't clear in this case either).  I'm not
actually sure this is the wrong behaviour, since I'm far from being a docshell guru.

Fairly low-risk patch is to show the error dialog in this case instead of
navigating to the error page, simply changing the line at:
http://lxr.mozilla.org/mozilla/source/docshell/base/nsDocShell.cpp#3057
to something like this (untested)
if (mUseErrorPages && aURI && aError != NS_ERROR_UNKNOWN_PROTOCOL)

Less than ideal, yes, but I defer to biesi/bz in this case.  I don't think we
have time for baking anything more complex for b5, and unless there's an obvious
fix I think this is the compromise solution.

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

> if (mUseErrorPages && aURI && aError != NS_ERROR_UNKNOWN_PROTOCOL)

I'd rather use:
  if (mUseErrorPages && aURI && aFailedChannel)
as an interim solution.

Comment 8

[Boris Zbarsky [:bzbarsky]]

So the problem is that all the state change stuff (the security state in
particular) expects a channel, right?  Or at least a request?

I guess we can't really fix that for 1.8.  :(

Comment 9

[Asa Dotzler [:asa]]

bz, is there some bandaid patch we could take here for 1.8?

Comment 10

[Mike Connor [:mconnor]]

Attachment: band-aid based on biesi's suggestion

not perfect, but hopefully rare enough to not matter much.  Its still better
than 1.0 by leaps and bounds.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 198362 [details] [diff] [review]
band-aid based on biesi's suggestion

Yeah, this is the band-aid... this reintroduces a bunch of bugs we had with the
invalid protocol error, none of them were really fatal, whereas this sort of
is.

For trunk, please file a followup bug on getting this right?

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 198362 [details] [diff] [review]
band-aid based on biesi's suggestion

time is short and we know we want this so pending an sr, this is approved to
land on the branch.

Comment 13

[Darin Fisher]

I noticed that view-source:bla://bla.com results in an error page that says that
view-source is an unknown protocol.  So, it seems to me that we have more than
just this bug w/ showing error pages for unknown protocols :-(

Comment 14

[Darin Fisher]

Comment on attachment 198362 [details] [diff] [review]
band-aid based on biesi's suggestion

au revoir, sr=darin

Comment 15

[Mike Connor [:mconnor]]

fixed branch and trunk.

filed Bug 311007 as the followup.

Comment 16

[Christian :Biesinger (don't email me, ping me on IRC)]

(In reply to comment #13)
> I noticed that view-source:bla://bla.com results in an error page that says that
> view-source is an unknown protocol.  So, it seems to me that we have more than
> just this bug w/ showing error pages for unknown protocols :-(

note bug 273968    

Comment 17

[Zarco Zwier]

The same problem now occurs after the popup:
- open a secure site
- try to open htttp://www.google.com

A popup is shown, saying the protocol is not registered, but the yellow bar stays.
Also, when subsequently opened tabs contain the https:// protocol, the yellow
bar is not visible:
- open
http://mozillanews.org/bonsai/?day=4&month=10&year=2005&range=7&product=Firefox
- open a bug in a new tab (I don't get the warning anymore)
- try to open htttp://www.google.com
- go back to the Bonsai tab
- open a bug in a new tab 
- the latter tab does not have a yellow bar

Comment 18

[Zarco Zwier]

Attachment: Screenshot

Comment 19

[Zarco Zwier]

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050930
Firefox/1.6a1

Hmmm, maybe I should try the latest nightly?
Be right back

Comment 20

[Zarco Zwier]

Now using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1)
Gecko/20051005 Firefox/1.6a1
Now I'm not getting the yellow bar at all when opening an SSL page

Comment 21

[Zarco Zwier]

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051008
Firefox/1.6a1 the problem now seems to have disappearred.