1457091 - Popunder restriction bypass with keydown and keypress event

Status: RESOLVED WORKSFORME

(Firefox :: Untriaged, defect)

Description

[deepakdas288]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Build ID: 20171024165158

Steps to reproduce:

Steps to reproduce the problem:
1. Navigate to https://vulnerabledoma.in/popunder/keyevent.html . In this page, two key event listeners are set:

onkeydown=function(){
    window.open('//example.com/','_blank','a');
}

onkeypress=function(){
    window.open('about:blank','_blank').close();
}

2. Press any key.
3. A popunder window is opened.


Actual results:

opoup opened




Expected results:

The popunder window should not be opened.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

I'm unable to reproduce this on 61 nightly, are you able to reproduce this on either nightly or the latest release?

Comment 2

[Daniel Veditz [:dveditz]]

I can't reproduce with ESR-52 either -- the popups are caught by the popup blocker. When I whitelist the attack site I get popups, but not pop-unders.

Comment 3

[deepakdas288]

i am able to reproduce in 56.0.2 (64-bit)

Comment 4

[Alex Gaynor [:Alex_Gaynor]]

Did you try with a more recent release?

Comment 5

[deepakdas288]

No

Comment 6

[Alex Gaynor [:Alex_Gaynor]]

Could you please see if you can reproduce with a newer releases; Firefox 56 is no longer supported.

Comment 7

[deepakdas288]

I just checked it's blocking by popup whitelist