1501803 - [1364] #9: Implement test to prevent regression of JS alerts vulnerability

Status: RESOLVED INCOMPLETE

(Firefox for FireTV Graveyard :: Security: General, defect)

Description

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Bug 1486879 must be implemented first: we should write a regression test to ensure this doesn't regress. This may depend on the implementation (e.g. if we don't handle JS alerts at all, we check they don't show up; if we disable them after repeated sends, we should test for that).

Comment 1

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

To be more explicit about the work to be done here: iirc, we no longer show dialogs for JS alerts (the default behavior) to prevent them from being spammed infinitely. We should write a test that verifies that a page that injects, "alert(...); confirm(...); prompt(...);" js will not show dialogs.

iirc, this test already exists for FFES: https://searchfox.org/mozilla-mobile/rev/9862df1b488acaeb27e83b7d062064252ba62473/firefox-echo-show/app/src/androidTest/java/org/mozilla/focus/integration/IWebViewDoesNotDisplayJsDialogsTest.kt

We should consider writing this test to be abstract to any application and sharing it via android-components.

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Product is not getting updates. https://support.mozilla.org/en-US/kb/end-support-firefox-amazon-devices