[tor-bugs] #7575 [EFF-HTTPS Everywhere]: WebAssign site produces litany of "Security Warning" alerts

[Tor Bug Tracker & Wiki]

#7575: WebAssign site produces litany of "Security Warning" alerts
----------------------------------+-----------------------------------------
 Reporter:  cypherpunks           |          Owner:  pde
     Type:  defect                |         Status:  new
 Priority:  normal                |      Milestone:     
Component:  EFF-HTTPS Everywhere  |        Version:     
 Keywords:                        |         Parent:     
   Points:                        |   Actualpoints:     
----------------------------------+-----------------------------------------
 VERSION: HTTPS Everywhere 3.0.4
 BROWSER: Firefox 17.0 on Windows

 While using [https://webassign.net/ WebAssign] as a logged in user and
 with HTTPS Everywhere protection enabled, one encounters a "Security
 Warning" for every click due to what the browser thinks is the submission
 of an unprotected form from an https-protected webpage. In reality (as
 verified using firefox's web console), HTTPS Everywhere is indeed
 converting the http POST link to https, but at a lower level than whatever
 causes the warning dialog.

 I suspect the reason HTTPS Everywhere can't convert the link ahead of time
 is due to its being generated by javascript such as this:

 !javascript:onclick=document.forms[0].clicked.value='31,17';document.forms[0].action.value='roster/view';%20document.forms[0].showAll.value='0';document.forms[0].submit(this);

 To reproduce:

  1. Go to
 [http://demo.webassign.net/v4cgi/login.pl?WebAssignUsername=demoteacher&WebAssignInstitution=demo&WebAssignPassword=demo&Department=v4demo
 the Webassign demo site]
    1. Note that this subdomain is not currently covered by the HTTPS
 Everywhere plugin, but the plugin could easily be extended for both
 testing and production purposes.
  1. Change the http to https (or have the HTTPS Everywhere do it for you
 by including demo.webassign.net)
  1. Click on something like "Roster"
  1. See the submission error

 Could someone please take a look at this?

 Thank you in advance

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7575>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online