433420 - clicking on link to rpmforce yum packages throws SSL alert dialog, can't examine cert or accept

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, defect)

Description

[matthew zeier [:mrz]]

Attachment: screen capture of alert dialog

Steps to reproduce:
1. goto the attached URL

-or-
1. Google for rpmforge
2. Click on the "yum RPM package for Red Hat"

Firefox tosses an Alert box warning of an invalid cert for rpmrepo.org and I'm unable to examine the certificate or accept.  

Was able to reproduce on OSX (build 2008051204) and XP (3.0b1).

Comment 1

[Reed Loden [:reed]]

I see this on a current nightly on Linux, too.

Comment 2

[matthew zeier [:mrz]]

Just to remove any issues, also duplicated on XP (3.0b5).  

Comment 3

[Mike Shaver (:shaver emeritus)]

On Vista with the latest nightly, I see HTML code in the alert.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

It's not obvious which part of that page links to rpmrepo.org. Perhaps the AdSense JS? Probably a dupe of bug 431712.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

On that page specifically, the alert appearing seems to be related to interaction with the page. I've gotten it a few times just after moving my mouse, or after switching back to that tab after having it loaded in the background for a while.

Comment 6

[Phil Ringnalda (:philor)]

Both stylesheets, the RSS feed, and the favicon all redirect to the broken https://rpmrepo.org/RPMforge

Comment 7

[Phil Ringnalda (:philor)]

The favicon. data:text/html,<link rel="icon" type="image/gif" href="http://rpmforge.net/pingvin.gif"> will give you (only once per browser session) a dialog-with-html.

Comment 8

[Mike Schroepfer]

(This is beltzner and schrep) - this really looks like a dup of 431712 as Gavin says.  This is annoying but given it doesn't happen everywhere we can pickup a fix in a dot release.

Comment 9

[Kai Engert [:KaiE:]]

The reason why the wording in the error dialog contains html markup is the recent work from bug 402210, which incorrectly assumed that the wording would always be used as part of an html error page.

Comment 10

[Kai Engert [:KaiE:]]

This bug actually complains about 4 different things:

- we get an error dialog.
  As I understand, you suspect this is because of the favicon.
  I guess that can be the same cause as bug 431712.

- we get html tags in the error dialog.
  This is a regression from bug 402210.

- it's not possible to view the bad cert.
  That's true. We could file an enhancement bug that requests to 
  add "view cert" to the error dialog.

- it's not possible to override the bad cert.
  This is by design.

Comment 11

[Mike Shaver (:shaver emeritus)]

Why is it by design that we can add an exception for certs we get from top-level pages, but not from invisible content?

Comment 12

[matthew zeier [:mrz]]

Grr.  The admin site to Mozilla's Zimbra install triggers this too (though because I'm referencing the IP address, not the hostname).

Comment 13

[Kai Engert [:KaiE:]]

I don't remember why I said "it's by design". I agree it should be possible to override certs for background connections, too.

A design for making that possible (chrome notifier, user inspects list of recent invalid certs, etc.) is at http://kuix.de/mozilla/sslauth/

Comment 14

[Dana Keeler (she/her) [:keeler]]

If I understand correctly, that alert dialog no longer exists.