630789 - No security feedback for "mixed" state by an initial network error in a newly inserted iframe

Status: NEW

(Firefox :: Security, defect)

Description

[YUKI "Piro" Hiroshi]

Steps to reproduce:
 1. Go to "https://addons.mozilla.org/"
 2. Run this bookmarklet in the location bar:
      javascript:var d = document;var i=d.createElement('iframe');
      i.setAttribute('src','https://unknownhost.localhost/');
      d.body.appendChild(i);void(0);
    (Note: "https://unknownhost.localhost/" is an invalid url for testing.
     It should not be connected to the host and Firefox will show
     "Server not found" error. So, as the result, this bookmarklet inserts
     an iframe which reports a network error, into a secure web page and
     changes the security state to "mixed".)

Expected Result:
  The locationbar icon turns to gray and the tooltip becomes to
  "This web site does not supply identity information."

Actual Result:
  The label of the locationbar icon stays "Mozilla Corporation (US)"
  with green background, and the tooltip still says
  "Verified by: VeriSign, Inc."


There is a comment in the source:
http://mxr.mozilla.org/mozilla-central/source/security/manager/boot/src/nsSecureBrowserUIImpl.cpp#1376
1376     // we'll treat "broken" exactly like "insecure",
1377     // i.e. we do not show alerts when switching between broken and insecure
1378 
1379     /*
1380       from                 to           shows alert
1381     ------------------------------     ---------------
1382 
1383     no or broken -> no or broken    => <NOTHING SHOWN>
1384 
1385     no or broken -> mixed           => mixed alert
1386     no or broken -> low             => low alert
1387     no or broken -> high            => high alert
1388     
1389     mixed, high, low -> no, broken  => leaving secure
1390 
1391     mixed        -> low             => low alert
1392     mixed        -> high            => high alert
1393 
1394     high         -> low             => low alert
1395     high         -> mixed           => mixed
1396     
1397     low          -> high            => high
1398     low          -> mixed           => mixed

This case seems to match to the case "no or broken -> mixed" but there is no alert actually.

By comparison, this security-state-changed alert works for network errors in an existing iframe. After the step 2, type this bookmarklet into the location bar:

  javascript:document.body.lastChild.contentWindow.location.href=
  'https://unknownhost.localhost/?';void(0);

Then, the locationbar icon turns to gray as I expected.

Comment 1

[YUKI "Piro" Hiroshi]

> This case seems to match to the case "no or broken -> mixed" but there is no
> alert actually.

Sorry, I misquoted. This is the case: "high -> mixed".

Comment 2

[YUKI "Piro" Hiroshi]

Instead of network errors, I can reproduce this "no security warning" with another uri: "about:logo". Even if an <iframe src="about:logo"/> is inserted to the page https://addons.mozilla.org/, the page still "Verified by: VeriSign, Inc.". I used a simple bookmarklet:

  javascript:document.body.innerHTML+='<iframe src="about:logo" />';void(0);