1233289 - Focusing the searchbar shouldn't refetch suggestions

Status: NEW

(Firefox :: Search, defect, P5)

Description

[donaldepage]

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0
Build ID: 20151029151421

Steps to reproduce:

1. type something into the search bar, eg. "abc"
2. click somewhere else, eg. click on the address bar
3. click on the search bar


Actual results:

The search provider was contacted for search suggestions and the search suggestion list is displayed.


Expected results:

The search provider should only be contacted for search suggestions after the textbox has changed, rather than on focus.

This is a issue because it allows the search provider to track users. Normally, no cookies are sent when getting suggestions from the search provider. However, the search box's contents are persisted after a search. Because of this bug, whenever a user tries to type a new search query, the previous search term is sent to the search provider. Therefore it's possible to track users' search history by correlating what the previous search term was.

Comment 1

[Florian Quèze [:florian]]

This behavior change was intentional with the new search UI implemented in bug 1088660 for Firefox 34.

The privacy issue described here could be avoided by caching the last search suggestions, so that we don't have to hit the network when reopening the panel for previously typed search terms.

Comment 2

[:shell escalante]

looking at this i would put this at a P5 as a low privacy exposure (since information is already going to the search provider - and the option to turn off suggestions exists).

am i missing something?

Comment 3

[:shell escalante]

looking at this i would put this at a P5 as a low privacy exposure (since information is already going to the search provider - and the option to turn off suggestions exists).

florian please correct me if i misinterpreted - otherwise just take off your need info

Comment 4

[Florian Quèze [:florian]]

(In reply to :shell escalante from comment #2)

P5 seems reasonable to me; I rephrased the summary to describe the part that's actionable here.

Comment 5

[Mark Banner (:standard8)]

Marco, what are you thoughts on this bug? Is there a reason that we're not caching this already?

Comment 6

[Marco Bonardo [:mak]]

I think the only reason is that potentially in the meanwhile the suggestions could have changed on the other side. It's very unlikely though, but the component was built to requery every time.
Off-hand it may be happening around these lines
https://searchfox.org/mozilla-central/rev/4f07d49f1c7a823da07e3a231ac87c6435c8fd58/browser/components/search/content/searchbar.js#258-263
but I don't know why we start an empty search and then invoke handleText, as well as I don't know why we don't preserve the old values rather than searching.
It is feasible technically, whether we want to spend time on it is a different story.

Comment 7

[Mark Banner (:standard8)]

Thank you, I agree this isn't high priority, but I think it still could be considered a valid bug, so will leave open for now.