1424512 - Confirmation message box makes it impossible to close window

Status: RESOLVED DUPLICATE of bug 1412559

(Core :: DOM: Core & HTML, defect)

Description

[me]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171112125346

Steps to reproduce:

When one refreshes a page that sends information Firefox displays a message box asking for confirmation to resend the data or abort. This message box is "on top" in that you need to either accept it or cancel it meaning it prevents the window from being closed.


Actual results:

Some website abuse this message box one notably manages to display this message box as soon as the mouse cursor leaves a particular area of the website and as long as the message box is not present one can not close the window (because the message box needs to be answered). Conveniently the message box appears around the middle of the screen such that when you answer your mouse cursor is in the area the website wants it to be and if you move the mouse cursor to try to close the window you leave this area and the website somehow triggers this message box again (not exactly sure how this happens, probably a JavaScript triggering some form of refresh?) and thus this means the window can't be closed. However, it is possible to close it using Alt+F4 which provokes a confirmation message ("Leave website" "Stay") which can be answered with "Leave website" and the website actually closes.


Expected results:

Not sure but websites shouldn't be able to these shenanigans.

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to me from comment #0)
> User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0)
> Gecko/20100101 Firefox/57.0
> Build ID: 20171112125346
> 
> Steps to reproduce:
> 
> When one refreshes a page that sends information Firefox displays a message
> box asking for confirmation to resend the data or abort. This message box is
> "on top" in that you need to either accept it or cancel it meaning it
> prevents the window from being closed.
> 
> 
> Actual results:
> 
> Some website abuse this message box one notably manages to display this
> message box as soon as the mouse cursor leaves a particular area of the
> website and as long as the message box is not present one can not close the
> window (because the message box needs to be answered). Conveniently the
> message box appears around the middle of the screen such that when you
> answer your mouse cursor is in the area the website wants it to be and if
> you move the mouse cursor to try to close the window you leave this area and
> the website somehow triggers this message box again (not exactly sure how
> this happens, probably a JavaScript triggering some form of refresh?) and
> thus this means the window can't be closed. However, it is possible to close
> it using Alt+F4 which provokes a confirmation message ("Leave website"
> "Stay") which can be answered with "Leave website" and the website actually
> closes.
> 
> 
> Expected results:
> 
> Not sure but websites shouldn't be able to these shenanigans.

I was reminded of the bug 1412559 (landed in 58) which sounds very similar to this one.

Hi Reporter,
Care to use the latest beta (58) or nightly (59) version to verify if your issue remains ? Additionally, providing URLs you ran into the problem is very helpful. Thank you!

Comment 2

[me]

It seems to be the same as bug 1412559 (and bugs bug 1416608 and bug 1423364) yes, making this another duplicate. Don't have the exact URL anymore, it was a phishing site trying to convince you to install a Firefox Update. Essentially anything that can (repeatably) trigger a modal dialogue blocking the window is potentially abusable by such sites.