843977 - (mozorg-mixedcontent) [tracking] Mixed Active Content on Mozilla Affiliated sites

Status: NEW

(Websites :: Other, defect, P2)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

This is a tracking bug for pages on mozilla.org sites that will break when the mixed content blocker is enabled (bug 834836). Note that this bug blocks bug 815321 (the overall tracking bug for the mixed content blocker), but not bug 834836 (the enabling of the mixed content blocker in Firefox). We expect Firefox 22 to ship with the mixed content blocker enabled, so any pages that aren't fixed before Firefox 22 ships will be (partially) broken in Firefox 22. Note that all of these pages are already partially broken in IE9+ unless the user explicitly chooses to allow non-secure content. In some cases, the pages are also already broken in Chrome.

Here is my original notice about this change to Firefox in dev-webdev:
https://groups.google.com/d/msg/mozilla.dev.webdev/ACiyFQC6UGo/XxZoDlz06P8J

Please read the thread for important information and suggestions for identifying and fixing mixed-content issues. I suggest replying to the dev-webdev thread with questions.

Note that we are going to start blocking this kind of content because it (<script src> in particular) is a major security issue for any HTTPS website. In particular, if you load non-HTTPS script, then a MitM can basically "undo" all the protection that SSL gives the page. For example, it is trivial for them to modify the page to steal passwords and non-HttpOnly cookies.

Comment 1

[Chris More [:cmore]]

bsternthal: this is a tracking bug that you should discuss with the dev team and maybe we do some hacking on during the offsite.

Comment 2

[Ian Melven :imelven]

Also mentioned by Stefan elsewhere :

https://openbadges.org, https://popcorn.webmaker.org, https:/reps.mozilla.org and https://webfwd.org 

These are not all mozilla.org sites obviously, but are still Mozilla sites IMO.

Comment 3

[Tanvi Vyas[:tanvi]]

(In reply to Ian Melven :imelven from comment #2)
> https://openbadges.org, https://popcorn.webmaker.org,
> https:/reps.mozilla.org and https://webfwd.org 
>

webfwd.org already has a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=844010

I filed bugs for popcorn.webmaker.org (https://bugzilla.mozilla.org/show_bug.cgi?id=865384) and openbadges.org (https://bugzilla.mozilla.org/show_bug.cgi?id=865381)

For reps.mozilla.org, I only see Mixed Passive Content.  Stefan/Ian - can you provide the link where Mixed Active Content was found?

> These are not all mozilla.org sites obviously, but are still Mozilla sites
> IMO.

This bug should be to track all Mozilla affiliated sites (whether they are *.mozilla.org or not). I'm changing the subject to refect that.

Comment 4

[Brandon Park]

On this Mozilla Blog Post the demo doesn't show up with Mixed Content Blocker on.
https://blog.mozilla.org/blog/2013/02/24/webrtc-ringing-a-mobile-phone-near-you/

Comment 5

[Tanvi Vyas[:tanvi]]

Is mozilla-russia.org a site that the Mozilla Foundation/Corporation owns?  It includes mixed content from yandex - https://bugzilla.mozilla.org/show_bug.cgi?id=888984

Comment 6

[[:Aleksej]]

(In reply to Tanvi Vyas [:tanvi] from comment #5)
> Is mozilla-russia.org a site that the Mozilla Foundation/Corporation owns? 
No, but it is the Russian localization and community site.

Comment 7

[Tanvi Vyas[:tanvi]]

The mixed content blocker will hit stable users on August 6th when Firefox 23 is released.  We really need to get all the dependency bugs fixed by then, or face potential embarrassment.  Is there anyone from webdev that can drive all these dependencies and make sure they get resolved in time?  

Note that most of the dependency bugs contain issues that already exist for users on stable versions of IE and/or Chrome.

Comment 8

[Ben (:bensternthal)]

Tanvi: I will take ownership of this bug and the blockers.

Comment 9

[Tanvi Vyas[:tanvi]]

(In reply to Ben (:bensternthal) from comment #8)
> Tanvi: I will take ownership of this bug and the blockers.

Thank you so much for helping with this Ben!