[tor-bugs] #7132 [EFF-HTTPS Everywhere]: Google calendar breaks in netvibes portal

[Tor Bug Tracker & Wiki]

#7132: Google calendar breaks in netvibes portal
----------------------------------+-----------------------------------------
 Reporter:  cypherpunks           |          Owner:  pde          
     Type:  defect                |         Status:  new          
 Priority:  normal                |      Milestone:               
Component:  EFF-HTTPS Everywhere  |        Version:  HTTPS-E 3.0.0
 Keywords:  httpse-ruleset-bug    |         Parent:               
   Points:                        |   Actualpoints:               
----------------------------------+-----------------------------------------

Comment(by mikkoharhanen):

 There's more to this bug than just a broken Google Calendar. I could not
 add any of the featured widgets (Google News, Wired News etc). In addition
 Netvibes is unusable with Chrome. To reproduce these it is enough to go to
 https://www.netvibes.com without HTTPS Everywhere.

 I could not fix these issues. I would recommend marking this ruleset as
 mixedcontent and default_off until someone smarter finds a solution:
 https://github.com/mikkoharhanen/https-
 everywhere/commit/b82391b56d27aa66f80aa2e73d2f3c67d95c66db
 ----
 [https://2214561086.nvmodules.netvibes.com/frames/uwa_netvibes.php?id=2214561086&NVdir=ltr&NVlang=en_US&NVuserId=262289030&NVlocale=fi&NVreadOnly=false&NVwidgetDomain=2214561086.nvmodules.netvibes.com&NVcommType=HTML5postMessage&NVsubspaceDomain=netvibes.com&NVthemeUrl=%2Fthemes%2Flumi%2Fscreen.css&preview=false&moduleUrl=http%3A%2F%2Fnetvibes.modules.free.fr%2Fmodules%2Fgcalendar%2Fgcalendar.html&nocache=false&height=200&bug=0&linkCal=&linkCal2=&linkCal3=&linkCal4=&title=&showTitle=true&showNav=true&showDate=true&showTabs=false&showPrint=false&showCalendars=true&mode=MONTH&heightG=400&wkst=&hl=&ctz=&googleApps=false
 Link] to the reported Google Calendar warning. It is about certificate
 mismatch. The certificate matches *.netvibes.com but not
 *.nvmodules.netvibes.com.

 Log about adding a widget:

 Without HTTPS Everywhere:
 GET
 http://www.netvibes.com/modules/multipleFeeds/providers/?p=nymag&cat=fi
 [HTTP/1.1 200 OK 57ms]
 POST http://www.netvibes.com/api/feeds/subscribe [HTTP/1.1 200 OK 911ms]
 GET
 http://www.netvibes.com/modules/multipleFeeds/providers/nymag/img/nymag_logo.png
 [HTTP/1.1 200 OK 49ms]
 GET http://avatars.netvibes.com/favicon/http://nymag.com [HTTP/1.1 200 OK
 59ms]
 GET
 http://www.netvibes.com/modules/multipleFeeds/providers/nymag/img/nymag_bg.png
 [HTTP/1.1 200 OK 67ms]
 GET
 http://pixel.nymag.com/imgs/daily/intel/2012/03/02/02_nugent.o.jpg/a_146x97.jpg
 [HTTP/1.1 200 OK 812ms]
 GET http://pixel.nymag.com/imgs/daily/intelligencer/2013/02/11/11-major-
 garrett-tweet.o.jpg/a_560x375.jpg [HTTP/1.1 200 OK 824ms]
 POST http://www.netvibes.com/ajax/save/userData.php?module.edit [HTTP/1.1
 200 OK 86ms]

 With HTTPS Everywhere:
 POST https://www.netvibes.com/api/my/widgets/90763146/create/multi
 [HTTP/1.1 200 OK 123ms]
 GET
 https://www.netvibes.com/modules/multipleFeeds/providers/?p=nymag&cat=fi
 [HTTP/1.1 200 OK 51ms]
 POST https://www.netvibes.com/ajax/save/userData.php?module.edit [HTTP/1.1
 200 OK 88ms]

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7132#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online