1437349 - Detect if user install certain software with external protocol

Status: RESOLVED DUPLICATE of bug 680300

(Core :: DOM: Security, defect)

Description

[Xiaoyin Liu]

Attachment: PoC

If a web page navigates to a URL with external protocol with JavaScript document.location.href = "<scheme>"; , Firefox throws an exception if the specified scheme is unknown. Web pages can detect if the scheme is registered by catching the exception. There are many schemes that are known to associate with specific programs.

For instance, "steam:" protocol is associated with Steam Game client. If document.location.href = "steam:" throws an exception, then the user doesn't have Steam client installed; if it doesn't throw an exception, the user has Steam installed. This is a privacy issue, because users don't expect websites can detect this info.

That being said, if a protocol is known to the system, trying to navigate to it opens a popup. So users will know and get confused if attackers exploit this issue. But, by the time they see the popups, the detection already completes.

Edge and Chrome don't throw exceptions when external protocols are unknown.

Steps to reproduce:
Open the PoC in Firefox: https://xiaoyinl.github.io/rrk492vg2/external_protocol/parent.html

Comment 1

[Xiaoyin Liu]

Attachment: parent.html - PoC

Comment 2

[Daniel Veditz [:dveditz]]

Arthur: another one for the fingerprinting list

Comment 3

[Tom Ritter [:tjr]]

Oh awesome - this looks like the correct POC Of Bug 680300 that I was struggling to write.

Comment 4

[Arthur Edelstein [:arthur]]

Thanks, Dan!

Comment 5

[Christoph Kerschbaumer [:ckerschb, back on May 21st]]

In that case I am marking this bug as a duplicate.