Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

conflict with HTTPS Everywhere #115

Closed
jsamuel opened this issue Dec 22, 2011 · 4 comments
Closed

conflict with HTTPS Everywhere #115

jsamuel opened this issue Dec 22, 2011 · 4 comments

Comments

@jsamuel
Copy link
Member

jsamuel commented Dec 22, 2011

imported trac ticket
created: 2010-06-19 10:37:52
reporter: justin

The [https://www.eff.org/https-everywhere HTTPS Everywhere] extension rewrites HTTP requests to HTTPS equivalents. I've noticed this with link clicks (e.g. wikipedia links in google results). I haven't looked into the HTTPS Everywhere code yet, but it's safe to assume that RP doesn't realize the rewritten requests correspond to the original http:// link clicks and so is blocking them.

There are likely other requests besides link clicks that are affected. Some of these may get messy to deal with in a way that doesn't accidentally allow requests that shouldn't have been allowed.

@jsamuel
Copy link
Member Author

jsamuel commented Dec 22, 2011

imported trac comment
created: 2010-06-19 18:36:28
author: justin

I've sent the attached patch to the email address on the HTTPS Everywhere page. The patch adds sending of rewrite notifications through the observer service. If this patch or something similar is added, RP can subscribe to the topic and use the information to allow requests that would have been allowed had they not be rewritten.

@jsamuel
Copy link
Member Author

jsamuel commented Dec 22, 2011

imported trac comment
created: 2010-06-28 15:27:53
author: justin

This doesn't seem to be happening with Fx 3.7a6pre. It may be the case that a Fx change doesn't cause shouldLoad to be called in some of the situations it was before.

Here's the RP output from a google search for "ipv6", then clicking on the wikipedia link. This is with RP 0.5.15a2 and HTTPS Everywhere 0.1.2.

{{{
[RequestPolicy] [INFO] [INTERNAL] Link clicked from https://encrypted.google.com/search?q=ipv6&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a to http://en.wikipedia.org/wiki/IPv6.
[RequestPolicy] [WARNING] [CONTENT] ** ALLOWED ** reason: User-initiated request by link click. type: 6, destination: http://en.wikipedia.org/wiki/IPv6, origin: https://encrypted.google.com/search?q=ipv6&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a, context: [object XULElement], mime: , null
}}}

And with Fx 3.0.19 (same version of RP and HTTPS Everywhere):

{{{
[RequestPolicy] [INFO] [INTERNAL] Link clicked from https://encrypted.google.com/search?q=ipv6&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a to http://en.wikipedia.org/wiki/IPv6.
[RequestPolicy] [WARNING] [CONTENT] ** BLOCKED ** reason: hosts don't match. type: 6, destination: https://secure.wikimedia.org/wikipedia/en/wiki/IPv6, origin: https://encrypted.google.com/search?q=ipv6&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a, context: [object XULElement], mime: , null
}}}

I initially noticed the problem with 3.6.3. It had the same behavior as 3.0.19.

@jsamuel
Copy link
Member Author

jsamuel commented Dec 22, 2011

imported trac comment
created: 2010-06-28 15:38:07
author: justin

Actually, it could just be which order each extension's shouldLoad is called in.

@jsamuel
Copy link
Member Author

jsamuel commented Dec 22, 2011

imported trac comment
created: 2010-10-16 19:10:51
author: justin

The !RequestPolicy changes to listen for the "https-everywhere-uri-rewrite" topic have been made in r359 and released in 0.5.16a1. (Oops, forgot to mention this ticket in the r359 commit message.)

I wasn't able to successfully test on 3.0.19 because I couldn't get https_everywhere to work there. Testing on 3.6.10 with the patch provided to https_everywhere works. I haven't had a conflict between the two extension in the Fx 4 betas.

I'll wait until https_everywhere is patched before closing this ticket. See https://trac.torproject.org/projects/tor/ticket/1574 for more info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant