The doorhanger is not triggered for certain breached websites even though they are populated in the pref

mozilla / blurts-addon

Mozilla Public License 2.0

5 stars 8 forks source link

The doorhanger is not triggered for certain breached websites even though they are populated in the pref #109

Open CiprianGeorgiu opened 6 years ago

CiprianGeorgiu commented 6 years ago

[Affected versions]:

Firefox 62.0
Firefox 63.0a1
Firefox Monitor 2.1

[Affected Platforms]:

Windows 10 x64
Windows 7 x64
macOS 10.13
Ubuntu 16.04 x64

[Prerequisites]: Prefs you'll need to set in about:config:

(boolean) extensions.fxmonitor.enabled - true
(string) extensions.fxmonitor.breachListURL - https://haveibeenpwned.com/api/v2/breaches

[Steps to reproduce]:

Launch Firefox.
Navigate to the following breached website: https://www.wildstar-online.com/en/

[Expected result]:

The doorhanger is triggered after the website is loaded.

[Actual result]:

The doorhanger is not displayed after the website is loaded.

[Regression]:

Not a regression.

[Notes]:

It seems that the breached website is populated in pref extensions.fxmonitor.warnedHosts but the doorhanger still doesn't show up.
I'll follow up with a comment in case other websites are affected by this bug

nhnt11 commented 6 years ago

I can't reproduce this - the doorhanger shows up for me.

CiprianGeorgiu commented 6 years ago

Hmm... strange. Now, I cannot reproduce the bug either with the https://www.wildstar-online.com/en/ website.

@nhnt11 - can you please try instead with these websites (https://eservices.durban.gov.za/v2/, https://www.malwarebytes.com/) they appear as pawned on https://haveibeenpwned.com/PwnedWebsites, but the door hanger doesn't show up for neither of the websites.

Also the pref extensions.fxmonitor.warnedHosts is not populated for the above 2 websites after accessing them.

Any ideas about this?

nhnt11 commented 6 years ago

@CiprianGeorgiu MalwareBytes is recorded in the list of breaches as malwarebytes.org, not malwarebytes.com. So unfortunately, since this site is now redirecting, there's not much we can do from our end. This is something we should talk to Troy about. As for eservices.durban.gov.za, I think the problem is that HIBP's breach list has the domain as "eservices.durban.gov.za", but the addon is only checking the "durban.gov.za" part (the base domain). Again, not sure what to do about this one, base domain is definitely the way to go, we probably need to ask Troy what he thinks.

nhnt11 commented 6 years ago

Re. the warnedHosts pref is not populated - this is expected, this pref is only updated when the doorhanger is shown.

groovecoder commented 5 years ago

Should we update this issue to be specific about the door-hanger not showing up on domains that are redirected?

groovecoder commented 5 years ago

@sandysage - can you tell us what the behavior should be for breached domains that are redirected?

tcinotto commented 5 years ago

keep in backlog.