840395 - confusing control center messages for http page with https iframe with mixed content

Status: RESOLVED INCOMPLETE

(Firefox :: Security, defect)

Description

[Honza Bambas (:mayhemer)]

STR:
run http://mochi.test:8888/tests/dom/tests/mochitest/localstorage/test_localStorageQuota.html

Comment 1

[Tanvi Vyas[:tanvi]]

Example url: http://people.mozilla.com/~tvyas/mixediframe2.html

There is an http page with an https iframe.

Comment 2

[Tanvi Vyas[:tanvi]]

Can you remind me what the issue is here?  If you have an HTTP page with an HTTPS iframe, then Mixed Content will be blocked on the HTTPS iframe in FF 23+.

See "Frame Descendants Rule" here: http://blogs.msdn.com/b/ie/archive/2011/06/23/internet-explorer-9-security-part-4-protecting-consumers-from-malicious-mixed-content.aspx

And here is a nice diagram:
http://ie.microsoft.com/testdrive/ieblog/2011/Jun/23_InternetExplorer9SecurityPart4ProtectingConsumersfromMaliciousMixedContent_5.png

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I think the icon has changed, but the issue is that if you open the control center, there's the text "connection is not secure" (because it's http) as well as the text "<product> has blocked parts of this page that are not secure" (due to the https iframe with mixed content), which is a little confusing.

Comment 4

[Marcela (Please NI request to Brindusa Tot)]

Hi Honza!
I'm trying to reproduce old bugs to see if we can resolve some.
Unfortunately, links suggested for testing, one on the Description and the other on comment 1, are not working anymore.
Due to Firefox having change a lot, maybe this problem doesn't happen anymore. I'm wondering if you can share it again.
Thanks!

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:serg, since the bug has high severity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Sergey Galich [:serg]]

None of the links provided work anymore and the problem description is incomplete. Please reopen when more details are available.