447885 - Self signed cert. exception UI requires JS to be enabled

Status: RESOLVED WORKSFORME

(Core :: Security, defect)

Description

[Matěj Cepl]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.9.0.1) Gecko/2008071615 Fedora/3.0.1-1.fc9 Firefox/3.0.1
Build Identifier: xulrunner-0:1.9-1.fc9.x86_64

 If you goto a page like:

https://lists.dulug.duke.edu/pipermail/yum/2007-August/010136.html

...then galeon/firefox/etc. will display a page telling you the SSL cert. is
self signed etc. ... however the UI to fix this requires you have JS enabled.

 It also seems retarded that you can't say "just enable for this session/30m or
whatever".

Reproducible: Always

Steps to Reproduce:
1.see above
2.
3.

Comment 1

[Daniel Veditz [:dveditz]]

Confirming the need for script -- do we need a <NOSCRIPT> section? Should we just remove the "click link to get buttons" bit (as in the expert mode)?

> It also seems retarded that you can't say "just enable for this session/30m
> or whatever".

You can: uncheck the "permanently store this exception" box and you get the cert enabled for just that session. For a site you visit more than once it is safer to remember the exception because then you will notice if someone is trying to intercept your connection with a different cert (this is analogous to SSH).

The fact that it takes four clicks to add the exception is being discussed elsewhere, I'm limiting this bug strictly to the undeniable problem that the SSL error dialog doesn't work if Javascript is disabled.

Comment 3

[Samuel Sidler (old account; do not CC)]

johnath: Any update here? We can't block on it for 1.9.0.2, but we'd love a fix for 1.9.0.3.

Comment 4

[Johnathan Nightingale [:johnath]]

tbh, I'm a little surprised to see this blocking branch.

I mean, we should definitely fix it; the alternative right now is to go through the cert manager, which is annoyingly-more-complicated.  But I can't get the behaviour described even by unchecking the "Enable Javascript" pref, I had to install NoScript and then override its default and tell it to block JS on neterror.  So maybe there is a more common path that I'm missing here?

You can also toggle the "browser.xul.error_pages.expert_bad_cert" pref to show the add exception block, of course, as Dan hints at.

None of which is meant to suggest that this isn't a real bug that we should fix, just that I'm not clear on why it rises to the level of branch-blocker.

Sam, Dan, what am I missing?

Comment 5

[Samuel Sidler (old account; do not CC)]

Hm, I think my assumption was that this affected accessibility at the time. I honestly don't remember why we plussed it though. Renominating so we can look at it during our triage today.

Comment 6

[Daniel Veditz [:dveditz]]

I must've had NoScript in the restrictive mode described by Johnathan, I can't reproduce this with a fresh profile with javascript disabled. Works fine.