Skip to content

Commit eedd0b8

Browse files
pdepde
committed
Slightly more sensible UI!
1 parent da720d3 commit eedd0b8

File tree

4 files changed

+84
-59
lines changed

4 files changed

+84
-59
lines changed

‎src/chrome/content/observatory-warning.xul‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,23 @@
1111
<script type="application/x-javascript" src="observatory-xul.js" />
1212
<image src="chrome://https-everywhere/skin/ssl-observatory-messy.jpg" />
1313
<vbox id="warning-container" flex="1">
14-
<label style="padding:25px;">EFF's SSL Observatory has issued a warning about the HTTPS certificiate(s) for this site</label>
15-
<spacer flex="2" />
14+
<label style="padding:25px;">&ssl-observatory.warning.text;</label>
15+
<spacer flex="1" />
1616
</vbox>
1717

1818
<commandgroup>
19-
<command id="showcert" oncommand="window.close()" />
19+
<command id="showcert" oncommand="show_certs()" />
2020
<command id="okay" oncommand='window.close()'
2121
/>
2222
</commandgroup>
2323

2424
<separator class="thin"/>
2525
<hbox>
2626
<spacer flex="2" />
27-
<button label="&ssl-observatory.warning.showcert;" accesskey="s"
27+
<button label="&ssl-observatory.warning.showcert;" accesskey="S"
2828
id="show-certificate" command='showcert'/>
2929
<spacer flex="1" />
30-
<button label="&ssl-observatory.warning.okay;" accesskey="o"
30+
<button label="&ssl-observatory.warning.okay;" accesskey="I"
3131
command='okay'/>
3232
<spacer flex="2" />
3333
</hbox>

‎src/chrome/content/observatory-xul.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
const CC = Components.classes;
2+
const CI = Components.interfaces;
23
VERB=1;
34
DBUG=2;
45
INFO=3;
@@ -170,3 +171,13 @@ function warning_populate(warningObj) {
170171
container.appendChild(spacer);
171172
}
172173
}
174+
175+
function show_certs() {
176+
var parent_win = window.arguments[1];
177+
var cert = window.arguments[2];
178+
if (!parent_win)
179+
alert("no parent window trying to show certs");
180+
CC["@mozilla.org/nsCertificateDialogs;1"]
181+
.getService(CI.nsICertificateDialogs)
182+
.viewCert(parent_win, cert);
183+
}

‎src/chrome/locale/en/ssl-observatory.dtd‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,8 @@ for names that it cannot resolve through the DNS system.">
9292

9393
<!ENTITY ssl-observatory.prefs.use "Use the Observatory?">
9494
<!ENTITY ssl-observatory.warning.title "WARNING from EFF's SSL Observatory">
95-
<!ENTITY ssl-observatory.warning.showcert "Show the certificates">
95+
<!ENTITY ssl-observatory.warning.showcert "Show the certificate chain">
9696
<!ENTITY ssl-observatory.warning.okay "I understand">
97+
<!ENTITY ssl-observatory.warning.text "EFF's SSL Observatory has issued a warning about the HTTPS certificiate(s) for this site">
9798

9899

‎src/components/ssl-observatory.js‎

Lines changed: 66 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ INFO=3;
1313
NOTE=4;
1414
WARN=5;
1515

16+
BASE_REQ_SIZE=6400;
17+
1618
// XXX: We should make the _observatory tree relative.
1719
LLVAR="extensions.https_everywhere.LogLevel";
1820

@@ -237,32 +239,8 @@ SSLObservatory.prototype = {
237239
}
238240

239241
if ("http-on-examine-response" == topic) {
240-
if (!this.myGetBoolPref("enabled"))
241-
return;
242-
if (this.torbutton_installed) {
243-
// Allow Tor users to choose if they want to submit
244-
// during tor and/or non-tor
245-
if (!this.myGetBoolPref("submit_during_tor")
246-
&& this.prefs.getBoolPref("extensions.torbutton.tor_enabled")) {
247-
return;
248-
}
249-
if (!this.myGetBoolPref("submit_during_nontor")
250-
&& !this.prefs.getBoolPref("extensions.torbutton.tor_enabled")) {
251-
return;
252-
}
253-
} else if (!this.myGetBoolPref("use_custom_proxy")) {
254-
this.log(WARN, "No torbutton installed, but no custom proxies either. Not submitting certs");
255-
return;
256-
} else {
257-
// no torbutton; the custom proxy is probably the user opting to
258-
// submit certs without strong anonymisation. Because the
259-
// anonymisation is weak, we avoid submitting during private browsing
260-
// mode.
261-
try {
262-
var pbs = CC["@mozilla.org/privatebrowsing;1"].getService(CI.nsIPrivateBrowsingService);
263-
if (pbs.privateBrowsingEnabled) return;
264-
} catch (e) { /* old browser */ }
265-
}
242+
243+
if (!this.observatoryActive()) return;
266244

267245
subject.QueryInterface(Ci.nsIHttpChannel);
268246
var certchain = this.getSSLCert(subject);
@@ -275,20 +253,47 @@ SSLObservatory.prototype = {
275253
}
276254

277255
if (subject.URI.port == -1) {
278-
this.submitChain(chainArray, new String(subject.URI.host));
256+
this.submitChain(chainArray, new String(subject.URI.host), subject);
279257
} else {
280-
this.submitChain(chainArray, subject.URI.host+":"+subject.URI.port);
258+
this.submitChain(chainArray, subject.URI.host+":"+subject.URI.port, subject);
281259
}
282260
}
283261
}
284262
},
285263

264+
observatoryActive: function() {
265+
if (!this.myGetBoolPref("enabled")) return false;
266+
if (this.torbutton_installed) {
267+
// Allow Tor users to choose if they want to submit
268+
// during tor and/or non-tor
269+
if (!this.myGetBoolPref("submit_during_tor") &&
270+
this.prefs.getBoolPref("extensions.torbutton.tor_enabled"))
271+
return false;
272+
if (!this.myGetBoolPref("submit_during_nontor") &&
273+
!this.prefs.getBoolPref("extensions.torbutton.tor_enabled"))
274+
return false;
275+
} else if (!this.myGetBoolPref("use_custom_proxy")) {
276+
this.log(DBUG, "No torbutton installed, but no custom proxies either. Not submitting certs");
277+
return false;
278+
} else {
279+
// no torbutton; the custom proxy is probably the user opting to
280+
// submit certs without strong anonymisation. Because the
281+
// anonymisation is weak, we avoid submitting during private browsing
282+
// mode.
283+
try {
284+
var pbs = CC["@mozilla.org/privatebrowsing;1"].getService(CI.nsIPrivateBrowsingService);
285+
if (pbs.privateBrowsingEnabled) return false;
286+
} catch (e) { /* old browser */ }
287+
}
288+
return true;
289+
},
290+
286291
myGetBoolPref: function(prefstring) {
287292
// syntactic sugar
288293
return this.prefs.getBoolPref ("extensions.https_everywhere._observatory." + prefstring);
289294
},
290295

291-
submitChain: function(certArray, domain) {
296+
submitChain: function(certArray, domain, channel) {
292297
var base64Certs = [];
293298
var fps = [];
294299
var rootidx = -1;
@@ -349,39 +354,27 @@ SSLObservatory.prototype = {
349354
else reqParams.push("private_opt_in=0");
350355

351356
var params = reqParams.join("&") + "&padding=0";
352-
var tot_len = 8192;
357+
var tot_len = BASE_REQ_SIZE;
353358

354359
this.log(INFO, "Submitting cert for "+domain);
355360
this.log(DBUG, "submit_cert params: "+params);
356361

357362
// Pad to exp scale. This is done because the distribution of cert sizes
358363
// is almost certainly pareto, and definitely not uniform.
359-
for (tot_len = 8192; tot_len < params.length; tot_len*=2);
364+
for (tot_len = BASE_REQ_SIZE; tot_len < params.length; tot_len*=2);
360365

361366
while (params.length != tot_len) {
362367
params += "0";
363368
}
364369

365-
//this.log(DBUG, "Padded params: "+params);
366-
367-
var req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
368-
.createInstance(Ci.nsIXMLHttpRequest);
369-
req.open("POST", this.submit_url+this.csrf_nonce, true);
370-
371-
// Send the proper header information along with the request
372-
// Do not set gzip header.. It will ruin the padding
373-
req.setRequestHeader("X-Privacy-Info", "EFF SSL Observatory: https://eff.org/r.22c");
374-
req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
375-
req.setRequestHeader("Content-length", params.length);
376-
req.setRequestHeader("Connection", "close");
377-
// Need to clear useragent and other headers..
378-
req.setRequestHeader("User-Agent", "");
379-
req.setRequestHeader("Accept", "");
380-
req.setRequestHeader("Accept-Language", "");
381-
req.setRequestHeader("Accept-Encoding", "");
382-
req.setRequestHeader("Accept-Charset", "");
383-
384370
var that = this; // We have neither SSLObservatory nor this in scope in the lambda
371+
372+
373+
var HTTPSEverywhere = CC["@eff.org/https-everywhere;1"]
374+
.getService(Components.interfaces.nsISupports)
375+
.wrappedJSObject;
376+
var win = HTTPSEverywhere.getWindowForChannel(channel);
377+
var req = this.buildRequest(params);
385378
req.onreadystatechange = function(evt) {
386379
if (req.readyState == 4) {
387380
if (req.status == 200) {
@@ -394,7 +387,7 @@ SSLObservatory.prototype = {
394387
that.log(WARN, "The SSL Observatory has issued a warning about this certificate for " + domain);
395388
try {
396389
var warningObj = JSON.parse(req.responseText);
397-
that.warnUser(warningObj);
390+
that.warnUser(warningObj, win, certArray[0]);
398391
} catch(e) {
399392
that.log(WARN, "Failed to process SSL Observatory cert warnings :( " + e);
400393
that.log(WARN, req.responseText);
@@ -416,12 +409,32 @@ SSLObservatory.prototype = {
416409
req.send(params);
417410
},
418411

419-
warnUser: function(warningObj) {
412+
buildRequest: function(params) {
413+
var req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
414+
.createInstance(Ci.nsIXMLHttpRequest);
415+
req.open("POST", this.submit_url+this.csrf_nonce, true);
416+
417+
// Send the proper header information along with the request
418+
// Do not set gzip header.. It will ruin the padding
419+
req.setRequestHeader("X-Privacy-Info", "EFF SSL Observatory: https://eff.org/r.22c");
420+
req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
421+
req.setRequestHeader("Content-length", params.length);
422+
req.setRequestHeader("Connection", "close");
423+
// Need to clear useragent and other headers..
424+
req.setRequestHeader("User-Agent", "");
425+
req.setRequestHeader("Accept", "");
426+
req.setRequestHeader("Accept-Language", "");
427+
req.setRequestHeader("Accept-Encoding", "");
428+
req.setRequestHeader("Accept-Charset", "");
429+
return req;
430+
},
431+
432+
warnUser: function(warningObj, win, cert) {
420433
var aWin = CC['@mozilla.org/appshell/window-mediator;1']
421434
.getService(CI.nsIWindowMediator)
422435
.getMostRecentWindow('navigator:browser');
423436
aWin.openDialog("chrome://https-everywhere/content/observatory-warning.xul",
424-
"","chrome,centerscreen", warningObj);
437+
"","chrome,centerscreen", warningObj, win, cert);
425438
},
426439

427440

0 commit comments

Comments
 (0)