335554 - [regression] New security message with Shockwave Flash (which depends on javascript: URL results being ASCII/UTF-8)

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060426 Minefield/3.0a1

1. New Profile
2. Make sure Flash 8.5 b246 is in your ../firefox/plugins/ dir
3. Go to http://www.fairybluelight.com/
4. Observe strange dialog:

"Adobe Flash Player Security.

Adobe Flash Player has stopped a potentually unsafe operation.

The following local application on your computer or network:

- h

is trying to communicate with this Internet-enabled location:

- as.casalemedia.com

To let this application communnicate with the Internet, click Settings. You must restart the application after changing your settings.

[OK] [SETTINGS]"

This dialog never used to be displayed, but since the 20060426 builds a few on IRC have noticed this dialog popping up reproducabley. (Additionally, clicking on "settings" button does not result in any settings being shown; the dialog is just dismissed. Also, I have no idea what the local application called "h" is.)

This msg was not displayed in firefox versions up to and including:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060425 Minefield/3.0a1 (2006042506)

This msg now appears on:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060426 Minefield/3.0a1 (2006042609)

Regression Range
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-04-25+05%3A00%3A00&maxdate=2006-04-26+10%3A00%3A00&cvsroot=%2Fcvsroot

Comment 1

[Steve England [:stevee]]

Slightly smaller regression range..

Doesn't Occur
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060425 Minefield/3.0a1 ID:2006042508 [cairo]

Occurs
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060426 Minefield/3.0a1 ID:2006042604 [cairo]

http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-04-25+09%3A00%3A00&maxdate=2006-04-26+04%3A00%3A00&cvsroot=%2Fcvsroot

Comment 2

[Ria Klaassen (not reading all bugmail)]

Tested negative in 1.9a1_2006042505 and positive in 1.9a1_2006042510.
Could it be that it first blocked that message (the notification bar said: 2 blocked popups) and later on only one blocked popup.  

Comment 3

[Steve England [:stevee]]

Also please note, exacly the same problem is seen when using "Shockwave Flash 8.0 r22" (the official release, rather than the beta mentioned in comment 0)

Comment 4

[Steve England [:stevee]]

Attachment: .swf that shows the problem but didn't used to

Comment 5

[Steve England [:stevee]]

1. New Profile
2. Install Flash (http://www.macromedia.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash)
3. Click on .swf attached to bug

Older versions (pre 20060425.08) didn't used to throw an error dialog, recent versions (post 20060426.04) now do.

Comment 6

[Ria Klaassen (not reading all bugmail)]

You also need to make a new profile before each test, otherwise you get wrong results.

Comment 7

[Steve England [:stevee]]

Going with Ria's upper limit of 1.9a1_2006042510 and my lower limit of 2006042508 the regression range looks like:
http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-04-25+09%3A00&maxdate=2006-04-25+10%3A30&cvsroot=%2Fcvsroot

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Can this be reproduced on Linux (preferably) or Mac OS X?  I gave up on my Windows build environment when the build requirements were constantly changing and the build documentation wasn't keeping up.

Comment 9

[Brian Polidoro]

There is not a linux version of the plugin at:
http://www.macromedia.com/software/flashplayer/public_beta/

But I do get the same problem on Mac OSX except the application field is blank instead of having an h.

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060428 Minefield/3.0a1
OSX 10.3.9

Comment 10

[CBWhiz]

reproducable on Win XP sp2.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060428 Minefield/3.0a1

Comment 11

[Ria Klaassen (not reading all bugmail)]

See the same problem on this site:
http://wetter.rtl.de/index_ok.html?page=http://wetter.rtl.de/deutschland/dt_rad.html&Color=0A48A5

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Could somebody with a build environment figure out which checkin caused this?

Comment 13

[Ria Klaassen (not reading all bugmail)]

With the regression range from 2006042508 to 2006042510 it could also be bug 153232 (checked in on 2006-04-25 07:33): 
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2006-04-25+07%3A00&maxdate=2006-04-25+10%3A00

Comment 14

[:Gavin Sharp [email: [e-mail]]]

Backing out the patch from bug 335298 fixes this.

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Could somebody retest in an hourly or nightly build produced after now?  (Those don't exist yet, but the hourly tinderbox-builds should in a few hours.)

Comment 16

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #15)
> Could somebody retest in an hourly or nightly build produced after now?  (Those
> don't exist yet, but the hourly tinderbox-builds should in a few hours.)

Testcase works with revision 1.124 of dom/src/jsurl/nsJSProtocolHandler.cpp.

Comment 17

[:Gavin Sharp [email: [e-mail]]]

To be clear, I get the expected result, no security message. I believe this bug can now be closed.

Comment 18

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

OK, fixed on trunk.

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

...and thanks for testing.

Comment 20

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060504 Minefield/3.0a1 ID:2006050413
Now WFM
--> Verified