From fedaa41f44b4157a2279432479bc17b5d71753c8 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Wed, 19 Aug 2020 17:44:09 -0400 Subject: [PATCH 01/11] Follow up to eb28b1f32 - Correct inputmethod build file by putting Keyboard.jsm back in EXTRA_JS_MODULES JSMs are NOT Components. --- dom/inputmethod/moz.build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dom/inputmethod/moz.build b/dom/inputmethod/moz.build index e6d9945655..d0e817ee29 100644 --- a/dom/inputmethod/moz.build +++ b/dom/inputmethod/moz.build @@ -6,10 +6,11 @@ EXTRA_COMPONENTS += [ 'InputMethod.manifest', - 'Keyboard.jsm', 'MozKeyboard.js', ] +EXTRA_JS_MODULES += ['Keyboard.jsm'] + JAR_MANIFESTS += ['jar.mn'] MOCHITEST_CHROME_MANIFESTS += ['mochitest/chrome.ini'] From 41ed98b736a282e0e02840bf9308763fda47c225 Mon Sep 17 00:00:00 2001 From: FranklinDM Date: Thu, 13 Aug 2020 17:30:13 +0800 Subject: [PATCH 02/11] [Pale-Moon] Issue #1826 - Restore missing close icon on the undo prompt at the quick dial page While this could've all been placed in the shared new tab style sheet, OSX does not include the SVG close icon used by the other platforms and has its own custom close icon. --- .../palemoon/themes/linux/newtab/newTab.css | 14 +++++++++----- application/palemoon/themes/osx/newtab/newTab.css | 15 +++++++++++---- .../palemoon/themes/shared/newtab/newTab.css.inc | 15 ++++++++------- .../palemoon/themes/windows/newtab/newTab.css | 15 +++++++++++---- 4 files changed, 39 insertions(+), 20 deletions(-) diff --git a/application/palemoon/themes/linux/newtab/newTab.css b/application/palemoon/themes/linux/newtab/newTab.css index 357b3139be..7250bd18e4 100644 --- a/application/palemoon/themes/linux/newtab/newTab.css +++ b/application/palemoon/themes/linux/newtab/newTab.css @@ -17,11 +17,15 @@ } #newtab-undo-close-button { - padding: 0; - border: none; - -moz-user-focus: normal; + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 16, 16, 0); + background-position: center center; + background-repeat: no-repeat; } -#newtab-undo-close-button > .toolbarbutton-icon { - margin: -4px; +#newtab-undo-close-button:hover { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 32, 16, 16); +} + +#newtab-undo-close-button:hover:active { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 48, 16, 32); } diff --git a/application/palemoon/themes/osx/newtab/newTab.css b/application/palemoon/themes/osx/newtab/newTab.css index b8b0fd6998..9a5327594e 100644 --- a/application/palemoon/themes/osx/newtab/newTab.css +++ b/application/palemoon/themes/osx/newtab/newTab.css @@ -22,8 +22,15 @@ } #newtab-undo-close-button { - -moz-appearance: none; - padding: 0; - border: none; - -moz-user-focus: normal; + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.png"), 0, 16, 16, 0); + background-position: center center; + background-repeat: no-repeat; +} + +#newtab-undo-close-button:hover { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.png"), 0, 32, 16, 16); +} + +#newtab-undo-close-button:hover:active { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.png"), 0, 48, 16, 32); } diff --git a/application/palemoon/themes/shared/newtab/newTab.css.inc b/application/palemoon/themes/shared/newtab/newTab.css.inc index 3341ba7e54..32d7aca357 100644 --- a/application/palemoon/themes/shared/newtab/newTab.css.inc +++ b/application/palemoon/themes/shared/newtab/newTab.css.inc @@ -43,13 +43,14 @@ body { outline: 1px dotted; } - -#newtab-undo-close-button > .toolbarbutton-text { - display: none; -} - -#newtab-undo-close-button:-moz-focusring { - outline: 1px dotted; +#newtab-undo-close-button { + -moz-appearance: none; + padding: 0; + border: none; + width: 16px; + height: 16px; + float: right; + right: 0; } /* TOGGLE */ diff --git a/application/palemoon/themes/windows/newtab/newTab.css b/application/palemoon/themes/windows/newtab/newTab.css index b8b0fd6998..ea68bb8067 100644 --- a/application/palemoon/themes/windows/newtab/newTab.css +++ b/application/palemoon/themes/windows/newtab/newTab.css @@ -22,8 +22,15 @@ } #newtab-undo-close-button { - -moz-appearance: none; - padding: 0; - border: none; - -moz-user-focus: normal; + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 16, 16, 0); + background-position: center center; + background-repeat: no-repeat; +} + +#newtab-undo-close-button:hover { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 32, 16, 16); +} + +#newtab-undo-close-button:hover:active { + background-image: -moz-image-rect(url("chrome://global/skin/icons/close.svg"), 0, 48, 16, 32); } From 02f79388b4123ec185483aa1516baff9df47447e Mon Sep 17 00:00:00 2001 From: Andy Date: Thu, 13 Aug 2020 12:22:55 -0700 Subject: [PATCH 03/11] [Pale-Moon] Issue #1717 - Padlock Improvements --- application/palemoon/base/content/padlock.js | 75 ++++++++++++++------ 1 file changed, 53 insertions(+), 22 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 9728c91371..8cad43e743 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -22,50 +22,84 @@ var padlock_PadLock = const wpl_security_bits = wpl.STATE_IS_SECURE | wpl.STATE_IS_BROKEN | wpl.STATE_IS_INSECURE | - wpl.STATE_IDENTITY_EV_TOPLEVEL | - wpl.STATE_SECURE_HIGH | - wpl.STATE_SECURE_MED | - wpl.STATE_SECURE_LOW; + wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT | + wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT | + wpl.STATE_IDENTITY_EV_TOPLEVEL; var level; - var is_insecure; var highlight_urlbar = false; switch (aState & wpl_security_bits) { - case wpl.STATE_IS_SECURE | wpl.STATE_SECURE_HIGH | wpl.STATE_IDENTITY_EV_TOPLEVEL: + case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL: level = "ev"; - is_insecure = ""; highlight_urlbar = true; break; - case wpl.STATE_IS_SECURE | wpl.STATE_SECURE_HIGH: + case wpl.STATE_IS_SECURE: + case wpl.STATE_IS_SECURE | + wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: level = "high"; - is_insecure = ""; highlight_urlbar = true; break; - case wpl.STATE_IS_SECURE | wpl.STATE_SECURE_MED: - case wpl.STATE_IS_SECURE | wpl.STATE_SECURE_LOW: + case wpl.STATE_IS_SECURE | + wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: level = "low"; - is_insecure = "insecure"; - break; - case wpl.STATE_IS_BROKEN | wpl.STATE_SECURE_LOW: - level = "mixed"; - is_insecure = "insecure"; highlight_urlbar = true; break; + case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT | + wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: + case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: + case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: case wpl.STATE_IS_BROKEN: level = "broken"; - is_insecure = "insecure"; highlight_urlbar = true; break; default: // should not be reached level = null; - is_insecure = "insecure"; + } + + if (level != null && level != "broken") { + var secUI = gBrowser.securityUI; + //if we wanted, we could use secUI.state instead of aState above? + var secState = secUI.QueryInterface(Ci.nsISSLStatusProvider).SSLStatus; + if (secState) { + secState.QueryInterface(Ci.nsISSLStatus); + var proto = secState.protocolVersion; + if (proto == Ci.nsISSLStatus.SSL_VERSION_3) { + level = "broken"; + } else if (proto == Ci.nsISSLStatus.TLS_VERSION_1 || + proto == Ci.nsISSLStatus.TLS_VERSION_1_1) { + level = "low"; + } + if (level != "broken") { + var aCipher = secState.cipherSuite; + if (aCipher.indexOf("_EXPORT") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_RC2_") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_RC4_") > -1) { + if (aCipher.indexOf("_MD5") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_SHA") > -1) { + level = "low"; + } + } else if (aCipher.indexOf("TLS_DHE_RSA_WITH_AES") > -1) { + level = "low"; + } else if (aCipher.indexOf("TLS_RSA_WITH_AES_128_") > -1) { + level = "low"; + } else if (aCipher.indexOf("_3DES_") > -1) { + level = "low"; + } + } + } } try { var proto = gBrowser.contentWindow.location.protocol; if (proto == "about:" || proto == "chrome:" || proto == "file:" ) { // do not warn when using local protocols - is_insecure = false; + highlight_urlbar = false; } } catch(ex) {} @@ -111,9 +145,6 @@ var padlock_PadLock = case "low": sectooltip = "Weak security"; break; - case "mixed": - sectooltip = "Mixed mode (partially encrypted)"; - break; case "broken": sectooltip = "Not secure"; break; From 782bcb46dc029667d576e478e57e2027684e8c19 Mon Sep 17 00:00:00 2001 From: Andy Date: Thu, 13 Aug 2020 13:39:27 -0700 Subject: [PATCH 04/11] [Pale-Moon] Issue #1717 - Low Cipher Changes --- application/palemoon/base/content/padlock.js | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 8cad43e743..68ffb39a06 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -84,11 +84,7 @@ var padlock_PadLock = } else if (aCipher.indexOf("_SHA") > -1) { level = "low"; } - } else if (aCipher.indexOf("TLS_DHE_RSA_WITH_AES") > -1) { - level = "low"; - } else if (aCipher.indexOf("TLS_RSA_WITH_AES_128_") > -1) { - level = "low"; - } else if (aCipher.indexOf("_3DES_") > -1) { + } else if (aCipher.indexOf("_DES_EDE3_") > -1) { level = "low"; } } From a3117f5b441d28dc7a5016147c344aa4b8e2ee20 Mon Sep 17 00:00:00 2001 From: Andy Date: Thu, 13 Aug 2020 18:52:51 -0700 Subject: [PATCH 05/11] [Pale-Moon] Issue #1717 - 3DES Detection This will do to start. Get a better list of what's being deprecated. --- application/palemoon/base/content/padlock.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 68ffb39a06..5e5b944dd4 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -84,7 +84,9 @@ var padlock_PadLock = } else if (aCipher.indexOf("_SHA") > -1) { level = "low"; } - } else if (aCipher.indexOf("_DES_EDE3_") > -1) { + } else if (aCipher == "TLS_RSA_WITH_3DES_EDE_CBC_SHA") { + level = "low"; + } else if (aCipher == "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA") { level = "low"; } } From 024f61bf38c605937f09932b4959ab20a32d139a Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 12:36:40 -0700 Subject: [PATCH 06/11] [Pale-Moon] Issue #1717 - Localize Padlock Tooltip --- application/palemoon/base/content/padlock.js | 29 +++++++++++++++---- .../en-US/chrome/browser/browser.properties | 5 ++++ 2 files changed, 29 insertions(+), 5 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 5e5b944dd4..10fbaafedb 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -132,19 +132,38 @@ var padlock_PadLock = secbut.hidden = true; secbut.removeAttribute("level"); } - + + let s_ev = "Extended Validated"; + let s_hi = "Secure"; + let s_lo = "Weak security"; + let s_no = "Not secure"; + let gLocale = document.getElementById("bundle_browser"); + if(!!gLocale) { + let n_ev = gLocale.getString("identity.padlock.ev"); + if(n_ev != null) + s_ev = n_ev; + let n_hi = gLocale.getString("identity.padlock.high"); + if(n_hi != null) + s_hi = n_hi; + let n_lo = gLocale.getString("identity.padlock.low"); + if(n_lo != null) + s_lo = n_lo; + let n_no = gLocale.getString("identity.padlock.broken"); + if(n_no != null) + s_no = n_no; + } switch (level) { case "ev": - sectooltip = "Extended Validated"; + sectooltip = s_ev; break; case "high": - sectooltip = "Secure"; + sectooltip = s_hi; break; case "low": - sectooltip = "Weak security"; + sectooltip = s_lo; break; case "broken": - sectooltip = "Not secure"; + sectooltip = s_no; break; default: sectooltip = ""; diff --git a/application/palemoon/locales/en-US/chrome/browser/browser.properties b/application/palemoon/locales/en-US/chrome/browser/browser.properties index 4c45e2513c..e757d7d427 100644 --- a/application/palemoon/locales/en-US/chrome/browser/browser.properties +++ b/application/palemoon/locales/en-US/chrome/browser/browser.properties @@ -280,6 +280,11 @@ identity.mixed_content=Your connection to this site is only partially encrypted, identity.unknown.tooltip=This website does not supply identity information. +identity.padlock.ev=Extended Validated +identity.padlock.high=Secure +identity.padlock.low=Weak security +identity.padlock.broken=Not secure + identity.ownerUnknown2=(unknown) # Edit Bookmark UI From 92eed10c3be31731f660708692cdc11d179d0fef Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 12:37:40 -0700 Subject: [PATCH 07/11] [Pale-Moon] Issue #1717 - Whitespace Cleanup --- application/palemoon/base/content/padlock.js | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 10fbaafedb..3a1ceb1dfc 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -100,7 +100,7 @@ var padlock_PadLock = highlight_urlbar = false; } } catch(ex) {} - + let ub = document.getElementById("urlbar"); if (ub) { // Only call if URL bar is present. @@ -116,15 +116,15 @@ var padlock_PadLock = padlock_PadLock.setPadlockLevel("padlock-ib-left", level); padlock_PadLock.setPadlockLevel("padlock-ub-right", level); } catch(e) {} - + padlock_PadLock.setPadlockLevel("padlock-sb", level); padlock_PadLock.setPadlockLevel("padlock-tab", level); }, - + setPadlockLevel: function(item, level) { let secbut = document.getElementById(item); var sectooltip = ""; - + if (level) { secbut.setAttribute("level", level); secbut.hidden = false; @@ -170,12 +170,12 @@ var padlock_PadLock = } secbut.setAttribute("tooltiptext", sectooltip); }, - + prefbranch : null, - + onLoad: function() { gBrowser.addProgressListener(padlock_PadLock); - + var prefService = Components.classes["@mozilla.org/preferences-service;1"].getService(Components.interfaces.nsIPrefService); padlock_PadLock.prefbranch = prefService.getBranch("browser.padlock."); padlock_PadLock.prefbranch.QueryInterface(Components.interfaces.nsIPrefBranch2); @@ -262,7 +262,7 @@ var padlock_PadLock = document.getElementById("padlock-ib-left").setAttribute("padshow", padshow); document.getElementById("padlock-ub-right").setAttribute("padshow", padshow); } catch(e) {} - + document.getElementById("padlock-sb").setAttribute("padshow", padshow); document.getElementById("padlock-tab").setAttribute("padshow", padshow); @@ -271,7 +271,7 @@ var padlock_PadLock = document.getElementById("padlock-ib-left").setAttribute("padstyle", padstyle); document.getElementById("padlock-ub-right").setAttribute("padstyle", padstyle); } catch(e) {} - + document.getElementById("padlock-sb").setAttribute("padstyle", padstyle); document.getElementById("padlock-tab").setAttribute("padstyle", padstyle); From c5ff8be4fbed3a879cae06482ae3f7e61ec5e195 Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 12:41:42 -0700 Subject: [PATCH 08/11] [Pale-Moon] Issue #1717 - Revert 3DES Check to Original Method for Now --- application/palemoon/base/content/padlock.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 3a1ceb1dfc..8ca9e292f3 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -84,9 +84,7 @@ var padlock_PadLock = } else if (aCipher.indexOf("_SHA") > -1) { level = "low"; } - } else if (aCipher == "TLS_RSA_WITH_3DES_EDE_CBC_SHA") { - level = "low"; - } else if (aCipher == "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA") { + } else if (aCipher.indexOf("_3DES_") > -1) { level = "low"; } } From 81001e37c3e0825a4c0bdfb937b2f49637245845 Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 14:28:16 -0700 Subject: [PATCH 09/11] [Pale-Moon] Issue #1717 - UXP Says Mixed Content is Broken We get a little more picky about it. --- application/palemoon/base/content/padlock.js | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 8ca9e292f3..c98bc46cf3 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -34,22 +34,22 @@ var padlock_PadLock = highlight_urlbar = true; break; case wpl.STATE_IS_SECURE: - case wpl.STATE_IS_SECURE | + case wpl.STATE_IS_BROKEN | wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: level = "high"; highlight_urlbar = true; break; - case wpl.STATE_IS_SECURE | + case wpl.STATE_IS_BROKEN | wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: level = "low"; highlight_urlbar = true; break; - case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT | wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: - case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: - case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL | + case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: case wpl.STATE_IS_BROKEN: level = "broken"; From 66a5df11c15559512b606c2719075e50db1ead89 Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 15:59:29 -0700 Subject: [PATCH 10/11] [Pale-Moon] Issue #1717 - Differentiate DV & EV Mixed Content UXP drops STATE_IDENTITY_EV_TOPLEVEL for Mixed Content. If we want to have different behaviors between DV and EV, we need to use nsISSLStatus. --- application/palemoon/base/content/padlock.js | 69 +++++++++----------- 1 file changed, 31 insertions(+), 38 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index c98bc46cf3..93aca82081 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -21,36 +21,15 @@ var padlock_PadLock = const wpl = Ci.nsIWebProgressListener; const wpl_security_bits = wpl.STATE_IS_SECURE | wpl.STATE_IS_BROKEN | - wpl.STATE_IS_INSECURE | - wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT | - wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT | - wpl.STATE_IDENTITY_EV_TOPLEVEL; + wpl.STATE_IS_INSECURE; var level; var highlight_urlbar = false; switch (aState & wpl_security_bits) { - case wpl.STATE_IS_SECURE | wpl.STATE_IDENTITY_EV_TOPLEVEL: - level = "ev"; - highlight_urlbar = true; - break; case wpl.STATE_IS_SECURE: - case wpl.STATE_IS_BROKEN | - wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: level = "high"; highlight_urlbar = true; break; - case wpl.STATE_IS_BROKEN | - wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: - level = "low"; - highlight_urlbar = true; - break; - case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | - wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT | - wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: - case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | - wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT: - case wpl.STATE_IS_BROKEN | wpl.STATE_IDENTITY_EV_TOPLEVEL | - wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT: case wpl.STATE_IS_BROKEN: level = "broken"; highlight_urlbar = true; @@ -59,33 +38,47 @@ var padlock_PadLock = level = null; } - if (level != null && level != "broken") { + if (level != null) { var secUI = gBrowser.securityUI; //if we wanted, we could use secUI.state instead of aState above? var secState = secUI.QueryInterface(Ci.nsISSLStatusProvider).SSLStatus; if (secState) { secState.QueryInterface(Ci.nsISSLStatus); - var proto = secState.protocolVersion; - if (proto == Ci.nsISSLStatus.SSL_VERSION_3) { - level = "broken"; - } else if (proto == Ci.nsISSLStatus.TLS_VERSION_1 || - proto == Ci.nsISSLStatus.TLS_VERSION_1_1) { - level = "low"; + if (secState.isExtendedValidation) { + if ((aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) || + (aState & wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT)) + level = "broken"; + else if (level == "high") + level = "ev"; + } else { + if (aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) + level = "low"; + else if (aState & wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT) + level = "high"; } if (level != "broken") { - var aCipher = secState.cipherSuite; - if (aCipher.indexOf("_EXPORT") > -1) { + var proto = secState.protocolVersion; + if (proto == Ci.nsISSLStatus.SSL_VERSION_3) { level = "broken"; - } else if (aCipher.indexOf("_RC2_") > -1) { - level = "broken"; - } else if (aCipher.indexOf("_RC4_") > -1) { - if (aCipher.indexOf("_MD5") > -1) { + } else if (proto == Ci.nsISSLStatus.TLS_VERSION_1 || + proto == Ci.nsISSLStatus.TLS_VERSION_1_1) { + level = "low"; + } + if (level != "broken") { + var aCipher = secState.cipherSuite; + if (aCipher.indexOf("_EXPORT") > -1) { level = "broken"; - } else if (aCipher.indexOf("_SHA") > -1) { + } else if (aCipher.indexOf("_RC2_") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_RC4_") > -1) { + if (aCipher.indexOf("_MD5") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_SHA") > -1) { + level = "low"; + } + } else if (aCipher.indexOf("_3DES_") > -1) { level = "low"; } - } else if (aCipher.indexOf("_3DES_") > -1) { - level = "low"; } } } From 6d0384a86f222f277d7a93f70227568a0c18cc44 Mon Sep 17 00:00:00 2001 From: Andy Date: Fri, 14 Aug 2020 16:49:32 -0700 Subject: [PATCH 11/11] [Pale-Moon] Issue #1717 - Total Level Rewrite SSLStatus is now used for basically everything. --- application/palemoon/base/content/padlock.js | 137 +++++++++---------- 1 file changed, 68 insertions(+), 69 deletions(-) diff --git a/application/palemoon/base/content/padlock.js b/application/palemoon/base/content/padlock.js index 93aca82081..74b1bdfc6b 100644 --- a/application/palemoon/base/content/padlock.js +++ b/application/palemoon/base/content/padlock.js @@ -16,81 +16,80 @@ var padlock_PadLock = onLocationChange: function() {}, onStatusChange: function() {}, onSecurityChange: function(aCallerWebProgress, aRequestWithState, aState) { - // aState is defined as a bitmask that may be extended in the future. - // We filter out any unknown bits before testing for known values. const wpl = Ci.nsIWebProgressListener; - const wpl_security_bits = wpl.STATE_IS_SECURE | - wpl.STATE_IS_BROKEN | - wpl.STATE_IS_INSECURE; var level; var highlight_urlbar = false; - - switch (aState & wpl_security_bits) { - case wpl.STATE_IS_SECURE: - level = "high"; - highlight_urlbar = true; - break; - case wpl.STATE_IS_BROKEN: - level = "broken"; - highlight_urlbar = true; - break; - default: // should not be reached - level = null; - } - - if (level != null) { - var secUI = gBrowser.securityUI; - //if we wanted, we could use secUI.state instead of aState above? - var secState = secUI.QueryInterface(Ci.nsISSLStatusProvider).SSLStatus; - if (secState) { - secState.QueryInterface(Ci.nsISSLStatus); - if (secState.isExtendedValidation) { - if ((aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) || - (aState & wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT)) - level = "broken"; - else if (level == "high") - level = "ev"; - } else { - if (aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) - level = "low"; - else if (aState & wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT) - level = "high"; - } - if (level != "broken") { - var proto = secState.protocolVersion; - if (proto == Ci.nsISSLStatus.SSL_VERSION_3) { - level = "broken"; - } else if (proto == Ci.nsISSLStatus.TLS_VERSION_1 || - proto == Ci.nsISSLStatus.TLS_VERSION_1_1) { - level = "low"; - } - if (level != "broken") { - var aCipher = secState.cipherSuite; - if (aCipher.indexOf("_EXPORT") > -1) { - level = "broken"; - } else if (aCipher.indexOf("_RC2_") > -1) { - level = "broken"; - } else if (aCipher.indexOf("_RC4_") > -1) { - if (aCipher.indexOf("_MD5") > -1) { - level = "broken"; - } else if (aCipher.indexOf("_SHA") > -1) { - level = "low"; - } - } else if (aCipher.indexOf("_3DES_") > -1) { - level = "low"; - } - } + var secUI = gBrowser.securityUI; + var secState = secUI.QueryInterface(Ci.nsISSLStatusProvider).SSLStatus; + if (secState == null) { + level = null; + } else { + highlight_urlbar = true; + secState.QueryInterface(Ci.nsISSLStatus); + // Step 1: Check EV + if (secState.isExtendedValidation) { + // Step 1 TRUE: Extended Validation + // Normal "ev" + // Mixed Content "broken" + if ((aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) || + (aState & wpl.STATE_LOADED_MIXED_DISPLAY_CONTENT)) + level = "broken"; + else + level = "ev"; + } else { + // Step 1 FALSE: Domain Validation + // Normal "high" + // Mixed Active Content "low" + if (aState & wpl.STATE_LOADED_MIXED_ACTIVE_CONTENT) + level = "low"; + else + level = "high"; + } + // Step 2: Check Protocol + if (level != "broken") { + // SSL 3 "broken" + // TLS 1.0 "low" + // TLS 1.1 "low" + var proto = secState.protocolVersion; + if (proto == Ci.nsISSLStatus.SSL_VERSION_3) + level = "broken"; + else if (proto == Ci.nsISSLStatus.TLS_VERSION_1 || + proto == Ci.nsISSLStatus.TLS_VERSION_1_1) { + level = "low"; } } - } - - try { - var proto = gBrowser.contentWindow.location.protocol; - if (proto == "about:" || proto == "chrome:" || proto == "file:" ) { - // do not warn when using local protocols - highlight_urlbar = false; + // Step 3: Check Bad Ciphers + if (level != "broken") { + // EXPORT "broken" + // RC2 "broken" + // RC4 + MD5 "broken" + // RC4 + SHA1 "low" + // 3DES "low" + var aCipher = secState.cipherSuite; + if (aCipher.indexOf("_EXPORT") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_RC2_") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_RC4_") > -1) { + if (aCipher.indexOf("_MD5") > -1) { + level = "broken"; + } else if (aCipher.indexOf("_SHA") > -1) { + level = "low"; + } + } else if (aCipher.indexOf("_3DES_") > -1) { + level = "low"; + } } - } catch(ex) {} + // Step 4: Check Boolean Problems + if (level != "broken") { + // Untrusted "broken" + // Domain Mismatch "broken" + // Expired (or too new) "broken" + if (secState.isUntrusted || secState.isDomainMismatch || + secState.isNotValidAtThisTime) + level = "broken"; + } + } let ub = document.getElementById("urlbar"); if (ub) {