873887 - security.mixed_content.block_display_content set to true breaks Zynga games

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[alanjstr]

I've experienced this with the current release as well as nightly.  Something about this is breaking at least one game, Hidden Chronicles.  There are other Zynga forum posts that suggest other games are affected.  This probably will fall under evangelism, but of course people might start by blaming the web browser and this default recently changed.



https://apps.facebook.com/hidden-chronicles/
https://zynga.com/play/hidden-chronicles

I tried safe-mode and that did not resolve it.  Toggling security.mixed_content.block_display_content allowed the game to fully load.

I caught these
Timestamp: 5/19/2013 6:56:39 PM
Error: [Exception... "'TypeError: location.host is null' when calling method: [nsIContentPolicy::shouldLoad]"  nsresult: "0x8057001c (NS_ERROR_XPC_JS_THREW_JS_OBJECT)"  location: "native frame :: <unknown filename> :: <TOP_LEVEL> :: line 0"  data: no]

and
Timestamp: 5/19/2013 6:56:55 PM
Error: Blocked loading mixed display content "http://media.zynga.com/image/828dbb0ebe6776df13d6eb584af0aca5a65d1b35:0:1049914904"
Source File: https://zynga1-a.akamaihd.net/zlive/snapi/gecf2533-prod/snapi.js
Line: 2

Comment 1

[Tanvi Vyas[:tanvi]]

Blocking Mixed Display Content will certainly break lots of pages.  Unfortunately, the web is full of Mixed Display Content.  However, Mixed Active Content (which poses a greater threat) is blocked by default in Firefox 23+.  The user can choose to also block mixed display, but will run into usability issues.

See the "What will the Mixed Content Blocker block" section in this blog post for more information on why we don't block Mixed Display Content by default - https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/

Thanks for the report!

Comment 2

[u279076]

Tanvi, so is this a bug in our implementation or should this report be closed?

Comment 3

[Tanvi Vyas[:tanvi]]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #2)
> Tanvi, so is this a bug in our implementation or should this report be
> closed?

Hi Anthony,
This is not a bug in our implementation.  If a user goes to about:config and turns on blocking of mixed display content, they will experience this problem.  And many other problems across the web.  But, this isn't the default for our users and a user has a choice to opt in to this broken but safer experience.

Hence, I think we should close the bug.

Comment 4

[u279076]

Thanks Tanvi, resolving this invalid as per your description in comment 3.

Comment 5

[Mike Kaply [:mkaply]]

I thought these bugs were being left open and moved to evangelism?

Comment 6

[Mike Kaply [:mkaply]]

Sorry, I read it wrong. Mixed display content. My bad.