Closed
Bug 889428
Opened 12 years ago
Closed 11 years ago
Switching tabs from a Nightly/UX tab to a Nightly/UX tab and then changing the URL maintains the Nightly/UX icon.
Categories
(Firefox :: Address Bar, defect)
Tracking
()
RESOLVED
FIXED
Firefox 25
Tracking | Status | |
---|---|---|
firefox24 | --- | unaffected |
firefox25 | - | affected |
People
(Reporter: suraj_patel_95, Assigned: jaws)
References
Details
(Keywords: csectype-spoof, sec-low, Whiteboard: fixed by bug 893424)
Attachments
(1 file, 4 obsolete files)
5.15 KB,
patch
|
Gavin
:
feedback+
|
Details | Diff | Splinter Review |
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130702 Firefox/24.0 (Nightly/Aurora)
Build ID: 20130702004019
Steps to reproduce:
1. Start a new browsing session.
2. Change the tab URL to about:home so that the Nightly/UX indicator is shown in the address bar.
3. Open a new tab and again navigate to about:home so that the Nightly/UX indicator is shown in the address bar.
4. Switch back to the first tab and change the URL to any normal web page.
Note that about:home could be any about: page which adds the indicator.
Actual results:
Nightly/UX page indicator remains.
Expected results:
It should disappear.
Reporter | ||
Updated•12 years ago
|
Summary: Switching tabs from a UX tab to a UX tab and then changing the URL maintains the UX icon. → Switching tabs from a Nightly/UX tab to a Nightly/UX tab and then changing the URL maintains the Nightly/UX icon.
Comment 1•12 years ago
|
||
I can reproduce this on Windows Nightly, but couldn't on OS X earlier today. Not sure why. Either way, confirming.
Updated•12 years ago
|
Component: Untriaged → Location Bar
Comment 2•12 years ago
|
||
Marking for tracking as this can make a website appear as trusted chrome UI.
Blocks: 750106
status-firefox24:
--- → unaffected
status-firefox25:
--- → affected
tracking-firefox25:
--- → ?
No longer depends on: 750106
Keywords: csec-spoof
Assignee | ||
Updated•12 years ago
|
Assignee: nobody → jaws
Status: NEW → ASSIGNED
Assignee | ||
Comment 3•12 years ago
|
||
I think this is a regression from bug 398360 actually, it's just that chromeUI wasn't introduced until bug 590206, and even at that it wasn't obvious when it was wrong until the patches for bug 750106 landed.
Assignee | ||
Comment 4•12 years ago
|
||
And https://bugzilla.mozilla.org/show_bug.cgi?id=398360#c6 mentions that onLocationChange won't be fired for error pages, which are the same as chrome pages as I understand it.
Assignee | ||
Comment 5•12 years ago
|
||
In the case where this is failing, onSecurityChange is being called before onLocationChange, but there is an implicit ordering dependency between these functions since onLocationChange resets this._hostChanged and onSecurityChange checks this value.
A simple patch here would be to only set this._hostChanged=false when the page is not a chrome URI, although that seems hacky.
I'm currently working on getting a mochitest that reproduces this broken ordering, but when I run this through mochitest the events appear in the order of onLocationChange then onSecurityChange. When I run these STR manually, I see onSecurityChange then onLocationChange.
Assignee | ||
Comment 6•12 years ago
|
||
Assignee | ||
Comment 7•12 years ago
|
||
Tests that pass without the patch applied, so something here isn't right...
Assignee | ||
Comment 8•12 years ago
|
||
Attachment #770660 -
Attachment is obsolete: true
Assignee | ||
Comment 9•12 years ago
|
||
This test reproduces the STR that were given in comment #0. It also demonstrates bug 882977.
Attachment #770661 -
Attachment is obsolete: true
Attachment #770673 -
Flags: review?(gavin.sharp)
Assignee | ||
Comment 10•12 years ago
|
||
Comment on attachment 770659 [details] [diff] [review]
Wallpaper patch
mach mochitest-browser browser/base/content/test
2:34.98 INFO TEST-START | Shutdown
2:34.98 Browser Chrome Test Summary
2:34.98 Passed: 6147
2:34.98 Failed: 0
2:34.98 Todo: 10
with the accompanied test applied. Without this patch the accompanied test fails.
Attachment #770659 -
Flags: review?(gavin.sharp)
Assignee | ||
Comment 11•12 years ago
|
||
(In reply to Suraj Patel from comment #0)
Thank you so very much for these detailed steps to reproduce. This was a very well written bug report. Welcome to Bugzilla! :-)
Assignee | ||
Comment 12•12 years ago
|
||
(In reply to Jared Wein [:jaws] from comment #4)
> And https://bugzilla.mozilla.org/show_bug.cgi?id=398360#c6 mentions that
> onLocationChange won't be fired for error pages, which are the same as
> chrome pages as I understand it.
I should point out that this assumption is likely wrong, as error documents likely replace the current document but keep the location the same.
Comment 13•12 years ago
|
||
We typically do not track security regressions less than sec-high/critical. We would take a low risk uplift if necessary though.
Assignee | ||
Updated•12 years ago
|
Attachment #770659 -
Flags: review?(dao)
Assignee | ||
Comment 14•12 years ago
|
||
Noticed some debugging code that should have been removed.
Attachment #770673 -
Attachment is obsolete: true
Attachment #770673 -
Flags: review?(gavin.sharp)
Attachment #774750 -
Flags: review?(gavin.sharp)
Attachment #774750 -
Flags: review?(dao)
Comment 15•12 years ago
|
||
Comment on attachment 770659 [details] [diff] [review]
Wallpaper patch
The whole _hostChanged thingy seems broken. I think we should fix that, not wallpaper over it.
Attachment #770659 -
Flags: review?(dao) → review-
Updated•12 years ago
|
Attachment #770659 -
Flags: review?(gavin.sharp)
Assignee | ||
Comment 16•12 years ago
|
||
Comment on attachment 770659 [details] [diff] [review]
Wallpaper patch
Made obsolete by the patch in bug 893424.
Attachment #770659 -
Attachment is obsolete: true
Comment 17•12 years ago
|
||
Comment on attachment 774750 [details] [diff] [review]
Tests v2.1
>diff --git a/browser/base/content/test/browser_bug889428.js b/browser/base/content/test/browser_bug889428.js
>+function loadURIInSelectedTab(aURL, aCallback) {
>+ gNewWin.gBrowser.selectedBrowser.addEventListener("load", function() {
>+ gNewWin.gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);
Use a named function rather than arguments.callee.
>+function test() {
>+ let oldTab = gBrowser.selectedTab;
unused?
The whole gNewWin/loadURIInSelectedTab/firstTab setup seems confusing, it seems like you could refactor this so that what's it's actually doing is a bit clearer (use a closure to avoid the need for gNewWin, avoid having helpers that operate on selectedTab and instead use explicit references to the relevant tabs, etc.).
Attachment #774750 -
Flags: review?(gavin.sharp)
Attachment #774750 -
Flags: review?(dao)
Attachment #774750 -
Flags: feedback+
Updated•12 years ago
|
Whiteboard: fixed by bug 893424
Target Milestone: --- → Firefox 25
Comment 18•11 years ago
|
||
Any reason this was still open?
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: needinfo?(jaws)
Flags: needinfo?(dao)
Resolution: --- → FIXED
Updated•11 years ago
|
Flags: needinfo?(dao)
Assignee | ||
Comment 19•11 years ago
|
||
It was just open for the test that was here. There hasn't been much progress on the test and I won't be having any time for it in the near future either, so it's fine to close this.
Flags: needinfo?(jaws)
You need to log in
before you can comment on or make changes to this bug.
Description
•