63212 - loading secure page on top of non-secure frame page opens new window

Status: RESOLVED FIXED

(Core :: Layout: Images, Video, and HTML Frames, defect, P1)

Description

[John Unruh]

1.) Visit http://junruh/sarita/frame.html
2.) Click on the secure left link
3.) Click on the secure right link
What is expected: The right side of the page would be secure, like with IE.
What happens: A new window is opened.

When I have a page using frames, if frame A (<a ... target=B>) tries to load a 
secure document into frame B, when frame B has a non-secure page, it results in 
a new browser window opened.

I can load a secure document into frame B from frame B, even when frame B 
currently contains a non-secure page.
Tested on Solaris and Win32.

Comment 1

[Javier Delgadillo]

Communicator does the same thing that you see.  Are you sure this isn't the way
it's supposed to be and IE isn't being over-friendly.

(I tried this using Communicator 4.76 w/ PSM on Solaris.)

Comment 2

[John Unruh]

This is the same bug as is in bugsplat, which is still open. This doesn't seem 
to be a security problem, just different from IE.
https://scopus.mcom.com/bugsplat/show_bug.cgi?id=387249

Comment 3

[David P. Drinan]

Changing product from Browser:Security:Crypto --> PSM 2.0

Comment 4

[Bob Lord]

->p2

Comment 5

[David P. Drinan]

->

Comment 6

[Stephane Saux]

Mass reassigning target to 2.1

Comment 7

[Stephane Saux]

test case description and test case do not match anymore.

Comment 8

[Stephane Saux]

P1

Comment 9

[John Unruh]

Mass assigning QA to ckritzer.

Comment 10

[David P. Drinan]

This is not a crypto issue since we do not control the open of browser windows. 
Re-assigning to the browser team.

Comment 11

[David P. Drinan]

Re-assigning for real, this time.

Comment 12

[David P. Drinan]

Assigning to default owners.

Comment 13

[Jussi-Pekka Mantere]

Removing nsenterprise, adding nsBranch.

Comment 14

[Kevin McCluskey (gone)]

Since my understanding is this is a different behavior than IE and not a
security problem, I am marking this nsbranch-. 

Comment 15

[elaineking]

removed keyword nsbranch since it now has nsbranch-, per pdt mtg.

Comment 16

[Kevin McCluskey (gone)]

Bulk reassignin HTML FRAME/IFRAME bugs to Eric.

Comment 17

[Kevin McCluskey (gone)]

Bulk re-assigning all of Eric's HTMLFrame bugs to John.

Comment 18

[Brad Nixon]

This affects logging into CommunityZero. To reproduce, go to:
http://www.communityzero.com/moztest. Login as u:moztest pw:test.

The community website will load in a new window from the login page.

This is really annoying when popups are turned off, because then you are forced
to hit the refresh button after the login page changes to the "Successful login"
page.

Comment 19

[John Keiser (jkeiser)]

Erm, it's been a year and a half with no dups and no topsites I can see, and
this isn't even awful behavior.  Nor can the original site even be reached. 
nsbeta1 why?  (I can't see bugsplat but perhaps you could email me with info on
how I can do so.)

Comment 20

[John Unruh]

Changed the URL. The site can be reached now, although it is in-house. Attaching 
a winzip which includes the test files, if you want to edit them for your own 
tests on a secure server. 

Comment 21

[John Unruh]

Attachment: frames.zip

Comment 22

[John Keiser (jkeiser)]

Sorry, there doesn't appear to be a secure right link at that URL?

Comment 23

[John Unruh]

If you are inside the firewall, the link should work as described now. I forgot 
to upload the new edited pages.

Comment 24

[John Keiser (jkeiser)]

Seems to work for me on WinXP trunk 2002061208.  Could you check trunk?

Here's my steps and what I see:
1. Load file.  Two frames, "This is non-secure left" and "This is non-secure right"
2. Click "secure left".  Left frame turns to "This is a secure left page."
3. Click "secure right" on the left frame.  Security dialog comes up and then
right frame turns to "This is a secure right page."

This seems right to me.

Comment 25

[John Unruh]

Marking fixed on trunk and branch. Mr. Nixon, can you try a more recent build?