New issue
Advanced search Search tips

Issue 823330 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 649869
Owner: ----
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 3
Type: Bug
Team-Security-UX



Sign in to add a comment

Error message is confusing for an iframe blocked by CSP/Mixed Content Blocker

Project Member Reported by rsleevi@chromium.org, Mar 19 2018

Issue description

Chrome Version: 65.0.3325.162
OS: macOS 10.13.3

What steps will reproduce the problem?
(1) Load https://datatracker.ietf.org/meeting/agenda/#quic
(2) Under the "Schedule" calendar (not the line-items), click the green "QUIC" session on Monday
(3) Click "Minutes" in that frame, which will attempt to load http://etherpad.tools.ietf.org:9000/p/notes-ietf-101-quic

What is the expected result?
An error message indicating either that
1) It was blocked due to the CSP policy
2) It was blocked due to being mixed content

What happens instead?
An error message indicating that the connection to the server "has been blocked by an extension"

The most likely cause by this is showing the error message for net::ERR_BLOCKED_BY_CLIENT in //components/error_page/common/localized_error


 
Cc: elawrence@chromium.org est...@chromium.org
Screen Shot 2018-03-19 at 12.55.59 PM.png
27.6 KB View Download

Comment 2 by est...@chromium.org, Mar 19 2018

Cc: edwardjung@chromium.org
Components: Blink>SecurityFeature>ContentSecurityPolicy
Labels: M-67 OS-Chrome OS-Linux OS-Mac OS-Windows
Status: Available (was: Untriaged)
I don't think we have a net error pages component, but this would fall under there if we did. The string in question is at https://cs.chromium.org/chromium/src/components/error_page_strings.grdp?type=cs&q=%22have+been+blocked+by+an+extension%22&sq=package:chromium&l=246 and should maybe say something more generic.
Cc: mmenke@chromium.org
Mergedinto: 649869
Status: Duplicate (was: Available)
There's a open bug as whether a new error code should be created. This is definitely confusing.

Sign in to add a comment