1232185 - Spoofable origin in geolocation requests

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, defect)

Description

[Juho Forsén [:jupenur]]

Attachment: Screenshot of the issue

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

Steps to reproduce:

1. Open Firefox for Android
2. Go to http://lab.igi.tl/woitnamvjndfdpln/geo.html
3. Tap on the link labeled 'Mozilla'
4. Wait for a few seconds as the mozilla.org website opens in a new tab
5. Notice the geolocation request and how it appears to be coming from mozilla.org


Actual results:

A geolocation request is initiated by lab.igi.tl (using an iframe sandbox to hide the actual origin). It appears on top of the mozilla.org website and contains the text 'mozilla.org' and no indicators about the real origin.


Expected results:

The geolocation request popup should always list the origin that triggered it. It should also force the requesting tab to the foreground to avoid confusion--the same way alert and confirm dialogs do.

Comment 1

[Daniel Veditz [:dveditz]]

Need to check other doorhanger types, this could be a general problem with timing and how that overlay determines where it came from. Ideally either the doorhanger is suppressed until you go back to the right tab or the doorhanger popping up drags you back to the related tab (which to choose I leave to the arguing of the UX folks).

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

I suspect that this is related to some of Jordie's bugs.

Comment 3

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Chenxia, do you know what might be going on here off the top of your head?

Comment 4

[:Margaret Leibovic]

I can reproduce this on release, but I can't reproduce it on Beta or Nightly.

I think we'll just need to just live with this for 43, but then it should be fixed afterwards. However, it's not immediately clear to me what caused this fix.

Juho, can you test this on Beta to confirm this is fixed there?

Comment 5

[Juho Forsén [:jupenur]]

Just grabbed 44.0b4 from Google Play, the behavior is exactly identical. Definitely not fixed.

Comment 6

[Juho Forsén [:jupenur]]

It's been awfully quiet here for the past two months... Any plans to fix this?

Comment 7

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Juho, I'm adding a flag so this should get discussed in next Thursday's triage (if no one responds before then).

Comment 8

[:Margaret Leibovic]

Just want to make sure this is on your radar.

Comment 9

[:Grisha Kruglov]

(In reply to :Margaret Leibovic from comment #8)
> Just want to make sure this is on your radar.

Sure is! Looking into this.

Comment 10

[:Grisha Kruglov]

Attachment: nightly behaviour (june 6) - seems fine?

Comment 11

[:Grisha Kruglov]

Hmm - we seem to be doing the right thing here on the latest nightly.

Screenshot above is my attempt to replicate this issue on the june 6th nightly. Doorhanger is only displayed when I return to the evil tab (lab.igi.tl), and I see no doorhanger however long I wait on the tab this is trying to spoof (mozilla.org).

Current Release and Beta from the Play Store behave exactly as described in Comment 0.

Comment 12

[:Grisha Kruglov]

To narrow things down further, current Aurora behaves improperly (as described in Comment 0).

Comment 13

[Kevin Brosnan [Ex-Mozilla]]

Testcase is gone and last comment said that this was WFM in Nightly.