Closed Bug 872910 Opened 7 years ago Closed 2 years ago

Page Info dialog box does not match identity block doorhanger for "Verisign, Inc." / "RSA Data Security, Inc."

Categories

(Firefox :: Security, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
Firefox 59
Tracking Status
firefox59 --- fixed

People

(Reporter: briansmith, Assigned: Kwan)

References

Details

Attachments

(1 file)

+++ This bug was initially created as a clone of Bug #870710 +++

The page info dialog box uses this logic to present the "RSA Data Security, Inc." certificate's name:

93 mapIssuerOrganization: function(name) {
94     if (!name) return null;
95 
96     if (name == "RSA Data Security, Inc.") return "Verisign, Inc.";
97 
98     // No mapping required
99     return name;
100   },

This logic was added in bug 47435 in the year 2000. It seems unlikely that we need to continue doing this, and in fact we don't do this for the box that drops down when you click the site identity block. We should remove this hack.

(In reply to neil@parkwaycc.co.uk from Bug 870710 comment #4)
> (In reply to Brian Smith from comment #2)
> > (From update of attachment 747950 [details] [diff] [review])
> > > +        if (issuerName == "RSA Data Security, Inc.")
> > > +          issuerName = "Verisign, Inc.";
> > 
> > I would avoid doing this special name handling. The Firefox code doesn't do
> > it, for example.
> > 
> > http://mxr.mozilla.org/mozilla-central/source/browser/base/content/browser.js#6517
> 
> Actually I was copying from here:
> 
> http://mxr.mozilla.org/mozilla-central/source/browser/base/content/pageinfo/
> security.js#96
Blocks: 82017
See Also: → 82017
From a representative of Symantec/VeriSign: "I agree that you can remove that code. The RSA root expired in 2005 and if it's still in your trust store you can remove it."

Also, I checked my spreadsheet of included root certs, and this root is no longer included, and we don't currently have expired root certs included in NSS.
Hey johannh, I picked you because you had the last review to pageinfo/security.js that was specific to it, rather then across-codebase refactorings. Hope that's okay, but feel free to redirect.
Assignee: nobody → moz-ian
Status: NEW → ASSIGNED
Comment on attachment 8936891 [details]
Bug 872910 - Remove obsolete mapIssuerOrganization function from Page Info security.

https://reviewboard.mozilla.org/r/207406/#review213530

That's fine, thanks for tackling this. I didn't even know that existed, haha.
Attachment #8936891 - Flags: review?(jhofmann) → review+
Thanks for the review!

Sheriff/c-n elf I haven't bothered to do a try run for this since nothing tests it and it's so trivial, but feel free to request one.
Keywords: checkin-needed
Pushed by csabou@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/8af400f42d91
Remove obsolete mapIssuerOrganization function from Page Info security. r=johannh
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/8af400f42d91
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → Firefox 59
You need to log in before you can comment on or make changes to this bug.