WebView.securityStatus.securityLevel indicates everything is normal if a subresource certificate error is allowed for a resource from a different domain from the main document

Bug #1368385 reported by Chris Coulson on 2014-09-11
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Oxide
Critical
Chris Coulson
1.2
Critical
Chris Coulson

Bug Description

I caught this whilst writing unit tests. If a secure site loads a resource from a different domain but that resource load comes with an invalid certificate, WebView.onCertificateError will fire with the isSubresource property set to true. If the application then allow's this, WebView.securityStatus.securityLevel does not indicate a degraded security level as expected.

It *does* work if the subresource is from the same domain as the main document, as that host is marked as having ran insecure content.

Changed in oxide:
importance: Undecided → Critical
status: New → Triaged
milestone: none → branch-1.3
assignee: nobody → Chris Coulson (chrisccoulson)
description: updated
Changed in oxide:
status: Triaged → In Progress
Chris Coulson (chrisccoulson) wrote :
Changed in oxide:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers