571508 - Totally useless "prevented a redirection" dialog

Status: RESOLVED WORKSFORME

(Toolkit :: Safe Browsing, enhancement)

Description

[Valdis Kletnieks]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.3a5pre) Gecko/20100609 Minefield/3.7a5pre
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.3a5pre) Gecko/20100609 Minefield/3.7a5pre

Visit the URL listed above.  Firefox puts up a little titlebar that says "Minefield prevented this page from automatically redirecting to another page", and a little "allow" button.

This is useless.

If a possibly-hostile redirection is detected, one of three things can sanely be done:

1) Don't bother intervening or even checking. Good for code efficiency :)
2) Get strict and *always* block it without an option.
3) If giving the user an option, provide enough info (such as where it is redirecting *to*), to allow the user to make an *informed* choice.

The current code does none of those.  Recommended alternative: Convert the 'Allow' to a 'Details', that would display the redirection target and a 'yes/no' option to the user.

There's a second related issue - it may be a good idea to make it more flexible, and allow 'Yes this time', 'Yes always (add to exception list)', and 'No'.

Reproducible: Always

Comment 1

[Johnathan Nightingale [:johnath]]

Do you have the Advanced->General->"Warn me when web sites try to redirect or reload the page" pref turned on? That is not default behaviour.

Comment 2

[Valdis Kletnieks]

Well, I just checked that, and I am *not* seeing it as a checked button. In addition, looking under 'about:config' shows the following:

1) 'accessibility.typeahead.flashBar' is the only non-default (highlighted) setting in the accessibility section.

2) 'accessibility.blockautorefresh' is set to the default 'false'.

Is the fact it's doing it even when it's unset *another* bug?

In any case, even if that preference was enabled, the current behavior is *still* bad, because the user doesn't get enough feedback to make the decision.

(Should I open another bug for the fact this option is misplaced under 'accessibility.*' rather than someplace more suitable, like browser.* or security.*?)

Comment 3

[Matthias Versen [:Matti]]

I get the warning only with enabled option and the default is off in a new profile. win32, Gecko/20100609 )

>Should I open another bug for the fact this option is misplaced under
>'accessibility.*' rather than someplace more suitable

but accessibility seems to be a good component for it.

Comment 4

[Matthias Versen [:Matti]]

I can not reproduce the issue without activating this feature in the options