Closed Bug 1674859 Opened 4 years ago Closed 1 year ago

Error when trying to save HTTP content with the HTTPS-only mode on

Categories

(Core :: DOM: Security, defect, P3)

defect

Tracking

()

VERIFIED FIXED
117 Branch
Tracking Status
firefox82 --- disabled
firefox83 --- disabled
firefox84 --- disabled
firefox116 --- wontfix
firefox117 --- verified
firefox118 --- verified

People

(Reporter: andremonizbr, Assigned: mjurgens)

References

(Blocks 1 open bug)

Details

(Whiteboard: [domsecurity-active])

Attachments

(1 file)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0

Steps to reproduce:

Enable the HTTPS-only mode
Open an HTTPS page that has direct HTTP links to files

Example: https://www.inoreader.com/feed/https%3A%2F%2Ffeeds.feedburner.com%2Fdsoh (requires an account to show the download links)

Actual results:

Firefox shows a popup with this error:

The download cannot be saved because an unknown error occurred. Please try again

Expected results:

Firefox should warn the user about the HTTP download and ask if he wants to download the file anyway, or at least be more specific about the error.

Missed the last step:

Right-click on one of the HTTP links and use the "Save link as..." option.

Logged in and tried to find the HTTP download links but couldn't find them. (for ex this one https://www.deepershades.net/dsoh-shows/deeper-shades-of-house-693-guest-mix-by-reezo-hassan.html had the "download first hour" as HTTPS connection).
Could you please send a link with a page from that site that has that download link with the insecure connection?

However, moving this over to its component. If that vague error shows up, it would be indeed nice to have a more specific error message.

Component: Untriaged → DOM: Security
Flags: needinfo?(emailmeat)
Product: Firefox → Core

Timea, the problematic download links are provided by their feed (and point to http://feeds.deepershades.net ), that's why I linked to a feed reader. You'd have to change the view mode to "extended view" to see them.

Anyway, I've made this for you to test it faster: https://firefox-test.000webhostapp.com/ .

Flags: needinfo?(emailmeat)

Reproducible on the latest Firefox Beta and Nightly versions (HTTPS-only is not a feature enabled by default in Release). Setting this up as a defect for now but it could also be considered an enhancement. The development team will look into this further.
Thank you very much for the simplified testcase and for the report!

Status: UNCONFIRMED → NEW
Ever confirmed: true
Severity: -- → S4
Priority: -- → P3
Whiteboard: [domsecurity-backlog1]

Also see bug 1662138

Version: Firefox 83 → Trunk

We should evaluate all download related bugs for https-first, hence marking this bug as blocking Bug 1704453.

Please mark my previous comments as outdated. Here's a new test page: https://bug1674859.netlify.app/

[Tracking Requested - why for this release]:

This does not seem to affect HTTPS-First

No longer blocks: https-first-mode
Assignee: nobody → mjurgens
Status: NEW → ASSIGNED
Whiteboard: [domsecurity-backlog1] → [domsecurity-active]
Attachment #9342368 - Attachment description: WIP: Bug 1674859: Disable HTTPS-Only for "Save-As" Downloads r?freddyb → Bug 1674859: Disable HTTPS-Only for "Save-As" Downloads r?freddyb
Pushed by fbraun@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/ba3c41770fa3 Disable HTTPS-Only for "Save-As" Downloads r=freddyb
Regressions: 1843036
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 117 Branch
QA Whiteboard: [qa-117b-p2]

Reproducible on a 2023-07-09 Nightly build on Windows 10.
Verified as fixed on Firefox 117.0b5(build ID: 20230808215502) and Nightly 118.0a1(build ID: 20230809213044) on Windows 10, macOS 12, Ubuntu 22.

Status: RESOLVED → VERIFIED
QA Whiteboard: [qa-117b-p2]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: