419552 - Blocklisting Java plugin still loads java

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Tony Chung [:tchung]]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b4pre) Gecko/2008022504 Minefield/3.0b4pre
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b4pre) Gecko/2008022504 Minefield/3.0b4pre

Trying to blocklist java, will still allow loading of java on websites.  

See screenshot

Reproducible: Always

Steps to Reproduce:
1. Load clean nightly trunk build.  ensure java is not installed.
2. set plugin blocklist settings called out at: https://bugzilla.mozilla.org/show_bug.cgi?id=391731#c3
3. Visit a website with java applet  (eg. see URL)
4. Notice java is not available.  click the area to find the plugin
5. PFS fails to find java, and allows for manual install
6. Manually download and install the java plugin from sun.java
7. Restart browser, and go to URL
8. Verify java applet loads, despite being blocklisted
9. Double confirm by opening Addons Manager > Plugins Tab, and verify the java plugin is blocklisted.
Actual Results:  
Java plugin shows blocklisted in addons manager, but still attempts to work on the website

Expected Results:  
java plugin should be blocklisted and unable to load.

Comment 1

[Tony Chung [:tchung]]

Attachment: Java plugin blocklist screenshot

Comment 2

[Dave Townsend [:mossop]]

Tony, any chance you could try installing the early access new Java Plugin and seeing if that suffers in the same way: https://jdk6.dev.java.net/6uNea.html

Comment 3

[Tony Chung [:tchung]]

Dave, its looking worse.   not only does Java SE6 U10 still reproduce the same as my STR, but it adds a duplicate entry of each plugin in the Addons Manager.

See screenshot 2. 

Comment 4

[Tony Chung [:tchung]]

Attachment: Java plugin SE 6 u10 screenshot

Comment 5

[Dave Townsend [:mossop]]

If that happens even without the blocklisting when the new java is installed then please file a Core::Plugins bug on it and request blocking.

Comment 6

[Tony Chung [:tchung]]

sorry false alarm on the duplicate entry thing.   Although same names appear, turns out with is the SE library, while the other is the plugin for DLL helper.  Original bug still stands though.

Comment 7

[Dave Townsend [:mossop]]

This is basically an effect of not having fixed bug 344638
*sigh*

Comment 8

[Dave Townsend [:mossop]]

This is probably going to take time to fix right but an inability to blocklist is not a good thing, though it should only be java.

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Mossop, could you have a look at this. Sounds bad that blocklisting isn't working.

Comment 10

[Daniel Veditz [:dveditz]]

(In reply to comment #8)
> an inability to blocklist is not a good thing, though it should only be java.

Blocking old versions of Java are #1 on my wishlist:
 - exploits for old java vulns are ubiquitous
 - java comes preinstalled on many OEMs. old versions
 - Firefox auto-discovers pre-installed java

Comment 11

[Dave Townsend [:mossop]]

Fixed by bug 419582

Comment 12

[James Klee]

 I have Java 6 downloaded in IE or in the XP operating system. I cannot get Mozilla to recognize the latest update. I cannot update in Mozilla. Says version 1.4 is latest. 

Comment 13

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

James: that looks very unrelated to this bug. I suggest you ask around in any of the support channels (google is your friend to find them)