443124 - Unable to accept certificate if https is in "Object" tag

Status: NEW

(Firefox :: Security, defect)

Description

[gaspard]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9) Gecko/2008052906 Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9) Gecko/2008052906 Firefox/3.0

If a web page contains an "object" tag that points to a https site which has an invalid certificate, nothing will ever be displayed.

The solution is open source code of HTML, search and go directly to the link, accept the certificate, return to the page and then you'll have access to the embedded page ("object" tag).


Reproducible: Always

Steps to Reproduce:
1. A TAG Object in a HTML file that points to a HTTPS site
2. https site with invalid certificate
3. Open the HTML page, no certificate warning and no certificate acceptation is displayed
Actual Results:  
Blank page

Expected Results:  
Display the warning in place of the object.

This is only for Firefox3, Firefox2 and its popup warning works well.

Comment 1

[Jo Hermans]

dupe of bug 399876 ?

Comment 2

[gaspard]

I think that it's closer to bug https://bugzilla.mozilla.org/show_bug.cgi?id=399760 "Problem 1".
But instead of an image, it is a webpage displayed in a frame using :
<object data="https://a_site_with_self_signed_cert/a_page.html" type='text/html' width="100%" height="600px"/>

Comment 3

[Jesse Ruderman]

<object> is interesting because of its fallback behavior (displaying its children).  Does it make sense to make some loading errors (e.g. file-not-found) trigger the fallback behavior and make other loading errors (e.g. invalid cert) show an error page as with an iframe?