542457 - Can't enable display of blocked remote content by specifying domain in mail.trusteddomains

Status: RESOLVED DUPLICATE of bug 568976

(MailNews Core :: Security, defect)

Description

[Malte Forkel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; de; rv:1.9.1.7) Gecko/20100111 Lightning/1.0b1 Thunderbird/3.0.1

I would like to enable the display of images embedded in HTML mails for all messages from a specific domain. I entered that domain (members.ebay.de) as sole value into the configuration parameter mail.trusteddomain without success. Running Thunderbird in safe mode and running a non-localized (en-US) version of Thunderbird didn't help either.

In the "Original HTML" display mode, the following header is inserted:
  Das Nachladen externer Inhalte wurde blockiert, um Ihre Privatsphäre zu schützen
  (Link) Externe Inhalte von [e-mail] immer laden
  (Button) Externe Inhalte anzeigen
In the en-US version, this is
  To protect your privacy, Thunderbird has blocked remote content in this message
  (Link) Always load remote content from [e-mail]
  (Button) Show Remote Content

In the "Simple HTML" ("Vereinfachtes HTML") display mode there is no inserted header, but the images aren't displayed as well.

See http://forums.mozillazine.org/viewtopic.php?f=28&t=1690065 for more information.

Reproducible: Always

Steps to Reproduce:
Select any message with embedded images from the domain specified in mail.trusteddomains
Actual Results:  
content is blocked

Expected Results:  
blocked content should be displayed

Comment 1

[Malte Forkel]

I've added a second domain (acm.org) to mail.trusteddomains (comma separated list, no blanks). That enabled the display of embedded content from that domain. 

So what's special about members.ebay.de? I looked at the source code of a small sample of messages with blocked content. They contained embedded images from pics.ebaystatic.com, thumbs.ebaystatic.com, and rover.ebay.com. After adding those to mail.trusteddomains, most emails were displayed without a warning. But some were not, even though they did not did not seem to contain images from other domains. Possibly, I overlooked other domains or was tricked by the disk cache. I finally even removed members.ebay.de from mail.trusteddomains without ill effects.

My (current :)) guess then is that mail.trusteddomain should list the origin domains of trusted embedded content and not the origin domain of mail containing trusted embedded content. This makes sense, but was not really obvious to me. I still have no explanation for the few emails not displayed without a warning.

Comment 2

[Ludovic Hirlimann [:Usul]]

Standard8 where do you collect content policy bugs ?

Comment 3

[Mark Banner (:standard8)]

MailNews Core / Security is probably the best place in this instance.

Comment 4

[Vincent (caméléon)]

I hope I don't make a mistake, but I am quite sure this is a duplicate...