489093 - "Mixed content" icon appears without any http:// loads

Status: RESOLVED DUPLICATE of bug 477118

(Firefox :: Security, defect)

Description

[Gervase Markham [:gerv]]

I've recently come across two occurrences of this. Here is one. Steps to reproduce:

1. Visit http://www.justgiving.com/nathanaelayling
2. Click "Sponsor Me Now..."
3. Enter name and amount and click "Donate"
   (don't worry, no actual money is required to reproduce!)

The resulting page has the mixed content icon. However, Firebug's Net panel shows no HTTP loads and the "show the mixed-content culprit" Greasemonkey script <http://userscripts.org/scripts/show/17437> also turns up nothing.

If this is a false positive, it will give people who are paying attention unnecessary concern, and reduce the trustworthiness of the indicator.

Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3

Gerv

Comment 1

[:Gavin Sharp [email: [e-mail]]]

I can't reproduce this, I see the EV UI when I follow those STR. Firebug itself may be to blame, have you tried disabling it? I seem to recall bugs about it's interaction with page content triggering the mixed content warnings.

Comment 2

[Gervase Markham [:gerv]]

OK, I found the problem. It was a Greasemonkey script which highlights password fields with a background, which is provides by inserting a background-image CSS with a data: URL.

Do we have any bugs about the interaction of data: URLs and SSL?

I'll attach the user script.

Gerv

Comment 3

[Gervase Markham [:gerv]]

Attachment: User script causing SSL breakage

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Yep, bug 477118.