841221 - Use HTTPS instead of HTTP for manual update link to firefox.com in Help|About dialog

Status: VERIFIED FIXED

(Firefox Graveyard :: Help Documentation, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #840687 +++
+++ This bug was initially created as a clone of Bug #771788 +++

app.update.url.manual;http://www.firefox.com

If somebody were trying to trick a user into installing a malicious update then I guess one way to do it would be to block automatic updates and then intercept this request if/when the user clicks the link in Help|About. So, I see some real security value in making this an HTTPS link, in the unlikely case the user can figure out how to do that.

firefox.com doesn't currently have a valid certificate; it uses the mozilla.org certificate.

Comment 1

[Chris More [:cmore]]

Firefox.com is not a website. It is 301 redirect to www.mozilla.org/firefox. We only use Firefox.com as vanity URL to get people to the mozilla.org Firefox download pages. www.mozilla.org/firefox redirects to either /firefox/new/ or /firefox/fx/ depending on what browser you are running.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Sounds like we should change the link to point to http://www.mozilla.org/firefox then.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Though I guess the idea was that this URL was displayed visible in a prompt to the user, so a nicer/simpler URL was a better choice. https://www.firefox.com does not work.

Comment 4

[Chris More [:cmore]]

There is a specific Firefox update URL that has version sniffing on it at:

https://www.mozilla.org/firefox/update/

but https://www.mozilla.org/firefox/ would be fine too. Just make sure there is a trailing slash on it avoid another redirect.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

OK, let's change to https://www.mozilla.org/firefox/

Comment 6

[Chris More [:cmore]]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #5)
> OK, let's change to https://www.mozilla.org/firefox/

Can you explain how people would be directed to this URL? I want to understand what the users see and when it happens because I am trying to explain a traffic pattern I am seeing on mozilla.org.

Comment 7

[:Gavin Sharp [email: [e-mail]]]

app.update.url.manual is the URL linked to in the About dialog when either the update download fails (for whatever reason), or when updates are disabled. The relevant context is:

"Updates available at _http://www.firefox.com_" (update system is disabled)
"Update failed. _Download the latest version_" (update download failed)

Comment 8

[Raymond Lee [:raymondlee]]

Attachment: v1

Redirect map:
https://www.mozilla.org/firefox/ -> https://www.mozilla.org/en-US/firefox/fx/

Comment 9

[Eldmannen]

(In reply to Raymond Lee [:raymondlee] from comment #8)
> v1

Can we get HTTPS for app.releaseNotesURL, app.vendorURL, and app.update.url.details too?

Comment 10

[Raymond Lee [:raymondlee]]

Attachment: v2

(In reply to Eldmannen from comment #9)
> (In reply to Raymond Lee [:raymondlee] from comment #8)
> > v1
> 
> Can we get HTTPS for app.releaseNotesURL, app.vendorURL, and
> app.update.url.details too?

Done.

I have also removed /projects/ part for app.releaseNotesURL because the url doesn't exists.

Comment 11

[Chris More [:cmore]]

(In reply to Raymond Lee [:raymondlee] from comment #10)
> Created attachment 720705 [details] [diff] [review]
> v2
> 
> (In reply to Eldmannen from comment #9)
> > (In reply to Raymond Lee [:raymondlee] from comment #8)
> > > v1
> > 
> > Can we get HTTPS for app.releaseNotesURL, app.vendorURL, and
> > app.update.url.details too?
> 
> Done.
> 
> I have also removed /projects/ part for app.releaseNotesURL because the url
> doesn't exists.

I am still seeing a lot of https://www.mozilla.org/projects/%APP%* in that file.

Comment 12

[Raymond Lee [:raymondlee]]

Attachment: v3

(In reply to Chris More [:cmore] from comment #11)
> I am still seeing a lot of https://www.mozilla.org/projects/%APP%* in that
> file.

I have removed them now.  

Do we still want https://www.mozilla.org/products/%APP%/ or should change it to https://www.mozilla.org/%APP%/ because both are redirected to https://www.mozilla.org/en-US/firefox/fx/?

Comment 13

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 721048 [details] [diff] [review]
v3

>diff --git a/browser/branding/aurora/pref/firefox-branding.js b/browser/branding/aurora/pref/firefox-branding.js

>+pref("app.update.url.manual", "https://www.mozilla.org/firefox/channel/");
>+pref("app.update.url.details", "https://www.mozilla.org/%APP%/");

I think these should probably just both point to https://www.mozilla.org/firefox/aurora/

>-pref("app.releaseNotesURL", "http://www.mozilla.org/projects/%APP%/%VERSION%/releasenotes/");
>-pref("app.vendorURL", "http://www.mozilla.org/projects/%APP%/");

These prefs are actually only used in about:, which is seldom-seen. I think we should just remove them (or make them optional). Can you remove these changes from the patch and file a new bug on doing that?

>diff --git a/browser/branding/nightly/pref/firefox-branding.js b/browser/branding/nightly/pref/firefox-branding.js

>+pref("app.update.url.manual", "https://nightly.mozilla.org/");
>+pref("app.update.url.details", "https://www.mozilla.org/%APP%/");

Similarly, let's make these both point to https://nightly.mozilla.org.

>diff --git a/browser/branding/official/pref/firefox-branding.js b/browser/branding/official/pref/firefox-branding.js

>+pref("app.update.url.details", "https://www.mozilla.org/%LOCALE%/%APP%/releases/");

I think we should use https://www.mozilla.org/en-US/firefox/%VERSION%/releasenotes/ for this.

>diff --git a/browser/branding/unofficial/pref/firefox-branding.js b/browser/branding/unofficial/pref/firefox-branding.js

>+pref("app.update.url.manual", "https://www.mozilla.org/products/%APP%/");
>+pref("app.update.url.details", "https://www.mozilla.org/%APP%/");

The goal for this package is to eventually use it as a replacement for "nightly". So for now, just use the same values as in the nightly file.

Overall, I think we should eliminate the use of %APP% in our URLs, since there's no valid use case where someone would want to change the value of %APP% but keep our mozilla.org URLs. So let's replace it with a hardcoded "firefox" whenever you're modifying URLs that include it.

I'll quickly review a patch implementing these changes.

Comment 14

[:Gavin Sharp [email: [e-mail]]]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #13)
> These prefs are actually only used in about:, which is seldom-seen. I think
> we should just remove them (or make them optional). Can you remove these
> changes from the patch and file a new bug on doing that?

I filed the bug: bug 876037.

Comment 15

[Raymond Lee [:raymondlee]]

Attachment: v4

Comment 16

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 754378 [details] [diff] [review]
v4

>diff --git a/browser/branding/official/pref/firefox-branding.js b/browser/branding/official/pref/firefox-branding.js

>-pref("app.update.url.details", "http://www.mozilla.com/%LOCALE%/firefox/releases/");
>+pref("app.update.url.details", "https://www.mozilla.org/en-US/firefox/%VERSION%/releasenotes/");

Sorry, I pasted the wrong link - there shouldn't be a hard-coded "en-US/" here.

r=me with that removed.

Comment 17

[:Gavin Sharp [email: [e-mail]]]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #16)
> >+pref("app.update.url.details", "https://www.mozilla.org/en-US/firefox/%VERSION%/releasenotes/");
> 
> Sorry, I pasted the wrong link - there shouldn't be a hard-coded "en-US/"
> here.

Hmm, on second thought, I think I made the wrong decision here. This is supposed to link to details about the available update, so linking to %VERSION%'s release notes won't give the right content. Let's hold off for a second while I try to find out if there's a better link for this.

Comment 18

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 754378 [details] [diff] [review]
v4

Also perhaps worth changing: using /%LOCALE%/ instead of the non-locale-specific links. We should probably be consistent with bug 840692 here.

Comment 19

[:Gavin Sharp [email: [e-mail]]]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #17)
> > >+pref("app.update.url.details", "https://www.mozilla.org/en-US/firefox/%VERSION%/releasenotes/");

OK, let's use:

https://www.mozilla.org/%LOCALE%/firefox/notes

for this pref in the "official" package.

Comment 20

[Raymond Lee [:raymondlee]]

Attachment: Patch for checkin

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #19)
> (In reply to :Gavin Sharp (use [e-mail] for email) from comment
> #17)
> > > >+pref("app.update.url.details", "https://www.mozilla.org/en-US/firefox/%VERSION%/releasenotes/");
> 
> OK, let's use:
> 
> https://www.mozilla.org/%LOCALE%/firefox/notes
> 
> for this pref in the "official" package.

Updated

Comment 21

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/36c05db04cc4

Comment 22

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/36c05db04cc4

Comment 23

[Camelia Badau [:cbadau], Desktop Test Engineering]

Verified fixed on Windows 7 64bit, Ubuntu 13.10 and Mac OSX 10.8.5 using latest Nightly 34.0a1.