615482 - Safebrowsing buttons are non-functional on sites with frames

Status: RESOLVED INCOMPLETE

(Camino Graveyard :: Security, defect)

Description

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

STR:

1) In a Camino with an up-to-date safebrowsing db, visit http://chansixnewsatnight.tk/
2) Click (because of bug 570838) on the "Close Page" button.

ER: Tab/window closes
AR: Nothing happens

3) Click on the "Ignore this warning" button

ER: Actual site is shown and blocker bar appears
AR: Nothing happens

At first I thought the "Ignore" button could be fixed by doing the same thing that Stuart did to fix bug 471120 (siteURI instead of [self currentURI]), but that doesn't appear to work.

What is happening is that pageURI is wrong in this case; it's returning the URL of the frameset instead of the URL of the error page, which causes the |else if ([pageURI hasPrefix:@"about:safebrowsingblocked"])| check to fail, rendering the buttons non-functional.  This means we're getting the wrong thing as the documentURI in |onXULCommand:|, and at that point we get into Gecko stuff, and it all goes over my head.

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Attachment: testcase

Here's a local testcase that uses our sample phishing page as the frame content so that we don't have to rely on a live site continuing to be live and continuing to have phishing sites in frames.

Comment 2

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Maybe we can fix this in 2.1.x, although in practicality it's less common and less important than the regression bug 570838.

Comment 3

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Maybe documentURI needs to do the same sort of things as bug 471120?

Comment 4

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

(In reply to Smokey Ardisson (not following bugs - do not email) from comment #3)
> Maybe documentURI needs to do the same sort of things as bug 471120?

I'll try to explore this for 2.1.2.