HTTPS Everywhere Switch Planner does not consider iframes an active element

[rbu]

I've been running a switch planner test on a site that displays an iframe from another HTTP site. This would trigger a mixed (active) content warning in Chromium, but it is neither recognized as active or passive content in Switch Planner.

[jeremyn]

Thanks for the report. Can you please be more specific on what the problem is, including a URL, specific test steps etc?

[rbu]

Consider the following HTML page:
https://jsbin.com/tepumogogo/1/edit?html,output

Before migration

When loading via HTTP, it shows the "http" iframe:
http://output.jsbin.com/tepumogogo

After migration

When loading via HTTPS, it does not show the "http" iframe:
https://output.jsbin.com/tepumogogo

Instead, Chrome shows an error:
Mixed Content: The page at 'https://output.jsbin.com/tepumogogo' was loaded over HTTPS, but requested an insecure resource 'http://hmpg.net/'. This request has been blocked; the content must be served over HTTPS.

However, the Switch Planner does not warn for it.

[jeremyn]

Thanks for the update. It sounds like you're describing broken mixed content at https://jsbin.com/tepumogogo/1/edit?html,output , which I can confirm.

What's a "Switch Planner"?

[jeremyn]

Never mind, I see now that it's an option in the HTTPS Everywhere tab of the Chrome dev tools.

[jeremyn]

I see, so it looks like this issue is that when you visit https://jsbin.com/tepumogogo/1/edit?html,output and turn on Switch Planner mode in the Chrome dev tools, it should report the iframe mixed content under Unrewritten HTTP resources loaded from this tab, but instead it reports none. Is that right?

[rbu]

Correct, I'm talking about that switch planner. From what I understand, you'd visit the HTTP variant of the page to receive the rewrite instructions.

Let me give you a differential example. In this pad: http://output.jsbin.com/hiquxinuli/1

The first 4 links have no HTTPS Everywhere rules (and they are not available as HTTPS). The last 4 rules are part of HTTPS Everywhere rules (and have HTTPS variants).

When I visit the http://output.jsbin.com/hiquxinuli/1 link with Switch Planner active, the first iframe (to hmpg) is not reported, the second iframe (to mh21) is reported. For the zeit and cdnjs links, all (PNG, CSS, JS) are reported.

[pipboy96]

The most likely reason is that the request itself is blocked before the extension can catch it.