418355 - Location bar remains yellow with mixed content on Linux

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Adam Barth]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008021804 Minefield/3.0b4pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008021804 Minefield

If an HTTPS page includes mixed content (e.g., by <script src="http://...), Firefox alters its security UI to indicate mixed content.  In particular, the following modifications are made:
1) An exclamation mark is added to he lock icon on the right of the status bar.
2) Larry changes his explanation of the site's identity information.
3) The address bar is changed from yellow to white.

On Linux, step 3 does not occur.  The address bar remains yellow, see:
<https://crypto.stanford.edu/~collinj/research/mixed-content/scripts/>
On Windows and Mac OS, the address bar does change to white.

Reproducible: Always

Steps to Reproduce:
1. Visit https://crypto.stanford.edu/~collinj/research/mixed-content/scripts/

Actual Results:  
The address bar is yellow.

Expected Results:  
The address bar should be white.

Comment 1

[Adam Barth]

Attachment: Don't show yellow if level=broken

Looks like the fix is a one-line change to the gnomestripe CSS.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Hrm, has this always been broken? This rule was added in the patch for bug 263750 a while ago (though it's moved around quite a bit since then to finally settle in browser.css).

Comment 3

[Adam Barth]

Interesting.  I don't remember seeing this behavior in FF2.  I'll look into this more tomorrow when I'm back in front of my Linux machine.

Comment 4

[Collin Jackson]

I think this issue may have been introduced by attachment 288852 [details] [diff] [review] for bug 398020:

 /* Secure site coloring */
-#urlbar[level="high"] > .autocomplete-textbox-container,
-#urlbar[level="low"] > .autocomplete-textbox-container {
+#urlbar[level="high"][pageproxystate="valid"] > .autocomplete-textbox-container,
+#urlbar[level="low"][pageproxystate="valid"] > .autocomplete-textbox-container,
+#urlbar[level="high"][pageproxystate="valid"] #autocomplete-security-wrapper,
+#urlbar[level="low"][pageproxystate="valid"] #autocomplete-security-wrapper,
+#urlbar[level="broken"][pageproxystate="valid"] #autocomplete-security-wrapper {
   background-color: #F5F6BE; /* #F7F898; */
   color: #000000;
 }

Comment 5

[Kai Engert [:KaiE:]]

Please feel free to assign to yourself, as I don't usually work on the product css. Thanks a lot for your help in getting this fixed!

Comment 6

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #4)
> I think this issue may have been introduced by attachment 288852 [details] [diff] [review] for bug
> 398020:

No, it was there before that patch (look for "-#urlbar[level="broken"] #autocomplete-security-wrapper {" in attachment 288852 [details] [diff] [review]). As I mentioned in comment 2, this was originally added in attachment 164481 [details] [diff] [review] for bug 263750, before Firefox 1.5.

I'd like to know whether this affects 1.5 and 2.0 as well, or whether that rule somehow didn't apply in those releases.

Comment 7

[Adam Barth]

I was able to reproduce this bug in Firefox 2 on Linux.  Looks like this has been broken for a while.

Comment 8

[Carsten Book [:Tomcat]]

(In reply to comment #6)
> I'd like to know whether this affects 1.5 and 2.0 as well, or whether that rule
> somehow didn't apply in those releases.
> 

confirmed on Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.8.1.12) Gecko/2008020121 Firefox/2.0.0.12, also affects also 1.8 builds on linux

Comment 9

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 304374 [details] [diff] [review]
Don't show yellow if level=broken

Eek, OK!

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 304374 [details] [diff] [review]
Don't show yellow if level=broken

a=beltzner for 1.9

Comment 11

[Reed Loden [:reed]]

Checking in browser/themes/gnomestripe/browser/browser.css;
/cvsroot/mozilla/browser/themes/gnomestripe/browser/browser.css,v  <--  browser.css
new revision: 1.182; previous revision: 1.181
done