952316 - Console errors on the about:accounts page

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, defect)

Description

[Peter deHaan [:pdehaan]]

Steps to reproduce:
1. Go to "about:accounts"
2. Open up the developer console.


Actual results:
Four JavaScript/Security warnings:
1) SyntaxError: Using //@ to indicate sourceMappingURL pragmas is deprecated. Use //# instead jquery-2.0.0.min.js:1
2) Error: https://accounts-latest.dev.lcip.org/javascripts/jquery-2.0.0.min.js is being assigned a //# sourceMappingURL, but already has one
3) Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen.[Learn More]
4) XUL box for x-tab element contained an inline #text child, forcing all its children to be wrapped in a block.

It looks like #1 (SyntaxError/sourceMap) is coming from jQuery and can be ignored, but the other 3 should be investigated. I can't understand why we're seeing the insecure passwords error since it looks like we're serving this locally.

Comment 1

[Tracy Walker [:tracy]]

I'm currently seeing just #3.

Comment 2

[Chris Karlof [:ckarlof]]

(In reply to [:tracy] Tracy Walker - QA Mentor from comment #1)
> I'm currently seeing just #3.

Everything is over https, but I suspect it might be freaking out we're embedding an https iframe containing password fields on an "about" page, and whatever is throwing that error is actually upset that there are passwords on a page that is "not https", rather than "http".

Comment 3

[Chris Karlof [:ckarlof]]

More info on #3: here's what checks the URI to determine if it isn't safe: http://mxr.mozilla.org/mozilla-central/source/toolkit/components/passwordmgr/InsecurePasswordUtils.jsm#78

"about" pages fail that check, so fixing this bug involves fixing that.

Comment 4

[Chris Karlof [:ckarlof]]

Not for Firefox 29.

Comment 5

[Peter deHaan [:pdehaan]]

Scary warning moved out into separate bug: https://bugzilla.mozilla.org/show_bug.cgi?id=983326

Comment 6

[Ryan Kelly [:rfkelly]]

Since (3) is tracked separately and the others no longer appear, I'm closing out this bug