787585 - Info bar block for Java 7 (u6 and below) on Mac OS X

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

Forked off from bug 785837. We need to extend the info bar block to Mac OS, given that Oracle distributes Java 7 independently, and Mountain Lion dropped Java support, so many Mac users possibly have installed the vulnerable versions.

Anthony, can you give me the plugin version numbers for Java 7 u5, u6 and u7 on Mac? I also need the information from about:plugins.

Comment 1

[u279076]

I ran into problems with this before. Here's the situation:

I was only able to install the 7u6 JRE by downloading and installing the Java 7u6 JDK. After installing this, I can install any other JDK but only the Java 7u6 plug-in appears in Firefox. I tried switching the active version through the Java control panel but it just won't seem to register any other plugin.

This is going to make it very hard to test.

At the very least, here is the info for Java 7u6:
Java Applet Plug-in
   File: JavaAppletPlugin.plugin
   Version: Java 7 Update 06
   Displays Java applet content, or a placeholder if Java is not installed.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

It's possible that the plugin is updated, but the info on about:plugins isn't reloaded. Deleting pluginreg.dat usually helps in that case. See bug 313700 (it should be fixed, though)

Comment 3

[u279076]

I don't think that will help because I can't even get other versions to appear in the Java Settings Manager in Mac OSX (external to Firefox).

Comment 4

[u279076]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #3)
> I don't think that will help because I can't even get other versions to
> appear in the Java Settings Manager in Mac OSX (external to Firefox).

PS. the only way I can see around this right now is to do a fresh install of Mac OSX for each test and that's way too much overhead to be realistic.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

I just installed Java 7 u7 and got this:

Java Applet Plug-in
    File: JavaAppletPlugin.plugin
    Version: Java 7 Update 07
    Displays Java applet content, or a placeholder if Java is not installed.

The block should be straightforward, though testing can be tricky as Anthony mentions.

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

I staged the Mac OS block here: https://addons-dev.allizom.org/en-US/firefox/blocked/p129

Juan, please give this a try. It should show the info bar block if you have Java 7 with an update version lower than 7, and it shouldn't show it for Java 6 or Java 7 update 7.

Comment 7

[juan becerra [:juanb]]

The blocklist entry gets updated, however I've noticed that the Java Applet Plug-in description in about:plugins is different from the one in the p129 blocklist entry. In my machine which has java version "1.6.0_35" this is what appears in about:plugins:

Java Applet Plug-in

    File: JavaAppletPlugin.plugin
    Version: 14.4.0
    Displays Java applet content, or a placeholder if Java is not installed.

I will install Java 7 in a different machine and see if the block bar shows.

Comment 8

[juan becerra [:juanb]]

I installed Java 7 u6 on a different machine, and I triggered the staged blocklist ping using Timer Fire (addon), but I did not see the bar block, though the plugin is listed as disabled in about:addons.

Do we need to set a severity for the block?

As an addendum to comment #7, the version in the blocklist matches what appears in about:plugins for Java 7.

Comment 9

[juan becerra [:juanb]]

Attachment: java 7 u6 blocked

Dialog indicating Java 7 u6 has been blocked and prompts user to restart the browser.

Comment 10

[juan becerra [:juanb]]

Java 7 u7 is not blocked.

Comment 11

[Jorge Villalobos [:jorgev] (he/him)]

D'oh! I forgot to set the severity to 0. It's set now. Can you please make sure the infobar appears on Java 7 u6? Sorry for the extra churn.

Comment 12

[juan becerra [:juanb]]

Attachment: java notification bar

I've tested this with the most recent Java 6 installation, in which there is no block, and I have tested this with Java 7 u7 (latest) on which there is no block bar showing.

When I use Java 7 u6, and I load a page with sample applet, I get the notification bar indicating there's an update for the plugin. The information in about:addons says something similar.

So the block is working.

All of this relies on people having enabled Java 6 when you are prompted by the operating system. For example in a fresh installation of Mac OS X 10.8 where I had not enabled Java 6 from the OS prompt, but where I had installed Java 7 u7, whenever I tried to open a sample clock applet, the application would close, and I would be prompted to enable Java 6.

Comment 13

[juan becerra [:juanb]]

Notice also a separate software update prompt (from the OS or Java?) comes up.

Comment 14

[Jorge Villalobos [:jorgev] (he/him)]

Done!
https://addons.mozilla.org/en-US/firefox/blocked/p138