504947 - Some Virus Scans report Trojan horse in 485217.xsl

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Alex Vincent [:WeirdAl]]

I've had a lot of trouble with hg clone in trying to get mozilla-1.9.1, mozilla-central code checked out.  Norton and Symantec antivirus products claim 485217.xsl is a Trojan horse.

I don't necessarily agree with that assessment, nor do I agree this is Mozilla's bug.  I'm filing it anyway, as UNCO, for tracking.  Please feel free to reassign, investigate, fix or mark INVALID as you see fit.

Comment 1

[Tyler Downer [He/Him]]

Um, yeah, probably invalid. Did you contact them about a false positive? They will usually update their definitions pretty quickly if they get some confirmed false positive reports.

Comment 2

[Alex Vincent [:WeirdAl]]

I tried to via their Help & Support chat system, but I don't think that was the right route to go.  I'd appreciate any pointers on where to go.

Comment 3

[Tyler Downer [He/Him]]

Well https://www-secure.symantec.com/norton/support/contact/email/email_form.jsp may help, but did the chat yield anything? I am trying to track some stuff down now.

Comment 4

[Tyler Downer [He/Him]]

Sorry for the spam, https://submit.symantec.com/false_positive/index.html.

Comment 5

[Alex Vincent [:WeirdAl]]

Thanks for the false positive link:

False Positive Submission

CONFIRMATION
Your submission has been sent Sat Jul 18 16:03:32 2009

To make another submission, click on False Positive Form

Sincerely,
Symantec Security Response

Comment 6

[Tyler Downer [He/Him]]

well, for now, INVALID.

Comment 7

[Tomas]

Time to close this bug?

Comment 8

[Justin Wood (:Callek)]

I was also frequently getting this error with TrendMicro.

After consulting with mrbkap on IRC was able to come up with a fix for my use.

Axel if you still have the antivirus you used to report this can you please re-test with m-c and let us know if this fixes it?

Pushed As: http://hg.mozilla.org/mozilla-central/rev/771e928c4a16

Comment 9

[Justin Wood (:Callek)]

Attachment: Patch as pushed

Requesting approval for 1.9.2 and 1.9.1; This is very very low risk and ensures that developer's virus scans don't mess up the Hg Repo unannounced.

Comment 10

[Bill Gianopoulos [:WG9s]]

Ah so Symantec is basing there anti-virus detection on the name you use for a function?  Really?  QWe need to out them.  They need to do a better job of real detection than this.

Comment 11

[Justin Wood (:Callek)]

(In reply to comment #10)
> Ah so Symantec is basing there anti-virus detection on the name you use for a
> function?  Really?  QWe need to out them.  They need to do a better job of real
> detection than this.

For the record I only tested with TrendMicro, but I suspect this is the same issue.  It is also why I asked Alex to verify if this fixes with the other scanners.

Comment 12

[Alex Vincent [:WeirdAl]]

Oh, oops.  I saw "Axel" in comment 8 and thought you meant someone else, a la Pike.  :)

No, I've since upgraded software, so I can't really retest this.

Comment 13

[Daniel Veditz [:dveditz]]

Comment on attachment 443987 [details] [diff] [review]
Patch as pushed

Approved for 1.9.2.5 and 1.9.1.11, a=dveditz

Comment 14

[Marco Bonardo [:mak]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/d098cf026cfc

Comment 15

[Justin Wood (:Callek)]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/cfb571fbc5f5