Open Bug 132279 Opened 24 years ago Updated 3 years ago

JS alert dialogs have no title in OS X

Categories

(Core :: Security, defect)

Product:
Core
Component:
Security
Platform:
PowerPC
macOS
Type:
defect

Tracking

()

People

(Reporter: adamlock, Assigned: dveditz)

References

Details

(Keywords: helpwanted)

In OS X, the alert/prompt/confirm dialogs boxes slide out from their parent window. This dialog box style has no title bar, so the user won't see the [Javascript Application] warning that we put in the title. This poses a security issue. Steps to reproduce: 1. Type "javascript:alert("hello")" in the URL on an OS X build.
.
Assignee: mstoltz → rjc
In Mac OS X terms, it is a "sheet"... aka a dialog which is modal to only its parent window. And yes, sheets do NOT have title bars.
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → WONTFIX
Not show the window title to the user for JS alerts may open us up for spoofing attacks. Mitch?
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
Over to security to think about better ways to indicate security issues than using title bars.
Assignee: rjc → mstoltz
Status: REOPENED → NEW
This bug is the result of ignoring bug 31573 comment 21. My recommendation now is the same as it was then: don't have a title for these (or any other) alerts, add `Web page alert: ' or similar to the *text* of the alert, and (if possible) color the alert in the same colors as the page.
Example of why using colors would be bad: <HTML><BODY TEXT="#CCCCCC" BGCOLOR="#CCCCCC" onLoad="alert('foo');"> <TABLE><TR><TD BGCOLOR="#000000"><FONT COLOR="#00FF00"> Text Here </FONT></TD></TR></TABLE> </BODY></HTML> Which color is appropriate to use for the text of an alert dialog? Light gray? I don't think so.
Andy, read bug 31573 comment 21 again. I specifically said it should be subject to a sanity check.
*** Bug 147294 has been marked as a duplicate of this bug. ***
mpt's reference from comment #5 gets most of the salient points from the dup, bug 147294, but there's one additional wrinkle, with Tabs. In bug 122126, m_mozilla@wickline.org pointed out that when you have multiple tabs in a window, a sheet ceases to become deterministically document modal. So you could have an onLoad handler that uses setTimeout to pull down a sheet sometime in the future. By then, the user may be on a different tab. I'm not sure how to exploit the user with this technique, but the behavior isn't right. Perhaps if the text was "Web page alert from <page title>:" it would reduce the odds of fooling the user. Page title would probably have to be clipped at a reasonable width. Plenty of sites have page titles of little value, but that's not our problem.
Comment 9 is a different problem, filed bug 208863 on that. As for this bug, the solution seems simple - add text to the alert itself saying that this is a script-generated alert. Who can do this?
Status: NEW → ASSIGNED
Keywords: helpwanted
Assignee: security-bugs → dveditz
Status: ASSIGNED → NEW
QA Contact: bsharma → toolkit
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.