HTTPS Everywhere Switch Planner does not consider iframes an active element #3938

Activity

1. jeremyn commented on Sep 4, 2016

   

   jeremyn

   on Sep 4, 2016

   Contributor

   More actions

   Thanks for the report. Can you please be more specific on what the problem is, including a URL, specific test steps etc?
2. rbu commented on Sep 5, 2016

   

   rbu

   on Sep 5, 2016

   Author

   More actions

   Consider the following HTML page:
   https://jsbin.com/tepumogogo/1/edit?html,output

   Before migration

   When loading via HTTP, it shows the "http" iframe:
   http://output.jsbin.com/tepumogogo

   After migration

   When loading via HTTPS, it does not show the "http" iframe:
   https://output.jsbin.com/tepumogogo

   Instead, Chrome shows an error:
   Mixed Content: The page at 'https://output.jsbin.com/tepumogogo' was loaded over HTTPS, but requested an insecure resource 'http://hmpg.net/'. This request has been blocked; the content must be served over HTTPS.

   However, the Switch Planner does not warn for it.
3. jeremyn commented on Sep 5, 2016

   

   jeremyn

   on Sep 5, 2016

   Contributor

   More actions

   Thanks for the update. It sounds like you're describing broken mixed content at https://jsbin.com/tepumogogo/1/edit?html,output , which I can confirm.

   What's a "Switch Planner"?
4. jeremyn commented on Sep 5, 2016

   

   jeremyn

   on Sep 5, 2016

   Contributor

   More actions

   Never mind, I see now that it's an option in the HTTPS Everywhere tab of the Chrome dev tools.
5. jeremyn commented on Sep 5, 2016

   

   jeremyn

   on Sep 5, 2016

   Contributor

   More actions

   I see, so it looks like this issue is that when you visit https://jsbin.com/tepumogogo/1/edit?html,output and turn on Switch Planner mode in the Chrome dev tools, it should report the iframe mixed content under Unrewritten HTTP resources loaded from this tab, but instead it reports none. Is that right?
6. rbu commented on Sep 6, 2016

   

   rbu

   on Sep 6, 2016

   Author

   More actions

   Correct, I'm talking about that switch planner. From what I understand, you'd visit the HTTP variant of the page to receive the rewrite instructions.

   Let me give you a differential example. In this pad: http://output.jsbin.com/hiquxinuli/1

   The first 4 links have no HTTPS Everywhere rules (and they are not available as HTTPS). The last 4 rules are part of HTTPS Everywhere rules (and have HTTPS variants).

   When I visit the http://output.jsbin.com/hiquxinuli/1 link with Switch Planner active, the first iframe (to hmpg) is not reported, the second iframe (to mh21) is reported. For the zeit and cdnjs links, all (PNG, CSS, JS) are reported.

   
7. pipboy96 commented on Mar 28, 2019

   

   pipboy96

   on Mar 28, 2019

   Contributor

   More actions

   The most likely reason is that the request itself is blocked before the extension can catch it.
8. pipboy96

   closed this as completedon Mar 31, 2019