+++ This bug was initially created as a clone of Bug #933432 +++ We need to pass the referrer and also check it against the blocklist.

Comment on attachment 8390277 [details] [diff] [review] Use referrer for application reputation checks ( Review of attachment 8390277 [details] [diff] [review]: ----------------------------------------------------------------- gcp, after I wrote https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc I realized that blocklisting trumps allowlisting. Also since we're supposed to eventually check the redirect chain against the blocklist, I went ahead and split that array up into 2. Paolo, please review Download changes. Thanks, Monica

Comment on attachment 8390277 [details] [diff] [review] Use referrer for application reputation checks ( Review of attachment 8390277 [details] [diff] [review]: ----------------------------------------------------------------- I only looked at DownloadIntegration.jsm, I get the other files are all for gcp to review? DownloadIntegration.jsm only needs the change below (no need to ask for review again on that file). ::: toolkit/components/jsdownloads/src/DownloadIntegration.jsm @@ +523,5 @@ > } > let deferred = Promise.defer(); > gApplicationReputationService.queryReputation({ > sourceURI: NetUtil.newURI(aDownload.source.url), > + referrerURI: NetUtil.newURI(aDownload.source.referrer), aDownload.source.referrer may be null or empty, in this case we shouldn't call newURI but just pass null.

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/db1dcce906fe for mochitest-5 and xpcshell bustages: https://tbpl.mozilla.org/php/getParsedLog.php?id=36101079&tree=Mozilla-Inbound https://tbpl.mozilla.org/php/getParsedLog.php?id=36101772&tree=Mozilla-Inbound

Thanks kwierso. I thought my try was green but I see now that the mac builds never finished: https://tbpl.mozilla.org/?tree=Try&rev=f09134d814aa

(In reply to Monica Chew [:mmc] (please use needinfo) from comment #7) > Thanks kwierso. I thought my try was green but I see now that the mac builds > never finished: > > https://tbpl.mozilla.org/?tree=Try&rev=f09134d814aa Argh, now they are finished, and still green for tests that broke on inbound :(

I forgot the uuid change, which explains why it was green on try on broke inbound.