1298083 - Don't hide blocklisted Flash from navigator.plugins

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Benjamin Smedberg]

When Firefox is set up to hide click-to-play Flash from navigator.plugins, this shouldn't affect the case where Flash is click-to-play because it is marked as vulnerable.

The reason for doing this is risk mitigation: the current UI has a risk of false-negatives which means sites become unusable, and that may affect our ability to deploy blocks. For now, we don't want any of this work to affect plugin blocking.

Comment 1

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: dont_hide_blocklisted.patch

been working on a test for this for a while and coming up empty.

Comment 2

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 8789057 [details] [diff] [review]
dont_hide_blocklisted.patch

Review of attachment 8789057 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry it's taken me so long to get to this - eating my way up through my review queue now.

This looks reasonable, but I don't really think I'm comfortable reviewing stuff in nsPluginArray.cpp. My experience with the more platform-y parts of plugins is limited at best. You might want bsmedberg to give this the go ahead.

Comment 3

[Benjamin Smedberg]

Comment on attachment 8789057 [details] [diff] [review]
dont_hide_blocklisted.patch

I'm not sure this is correct, but I had trouble following the code.

For the case we care about here, the blocklist state should be STATE_VULNERABLE_UPDATE_AVAILABLE or STATE_VULNERABLE_NO_UPDATE. That's the case where we end up in a click-to-activate setting by default. The case where the plugin is hardblocked doesn't really apply to Flash.

I think translates to a plugin tag that is *not* IsBlocklisted(). The best check there is probably GetBlockListState() != 0.

r=me with that change

Comment 4

[Benjamin Smedberg]

Without an automated test, we should definitely get some manual verification from Michelle.

Comment 5

[Michelle Funches - QA]

QA Update: yes I can arrange for testing

Comment 6

[Michelle Funches - QA]

QA UPdate: 
 Please review https://docs.google.com/spreadsheets/d/1VNljSnOkciM471nWVI4dQBVF1RUf3ULh-jUU1CT-J-k/edit#gid=971383501 for test results.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/471872efc401
Don't hide blocklisted Flash from navigator.plugins r=bsmedberg

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/471872efc401