1526134 - Firefox Focus (iOS): Recovery of previous searches across app closure/Browser Clear

Status: RESOLVED FIXED

(Focus :: Security: iOS, defect)

Description

[Matthew Remacle]

How was this issue discovered:

• Walking up the stairs to my house I noticed a search term that I had looked up during a conversation with a coworker 3 days prior. I knew full well that I had cleared my history several times since that point in time. Took a screenshot and knew there had to be a way to reproduce the bug. 6 hours to first reproduction of bug, each time got easier and faster. 20h total. I can now consistently reproduce every time.

Hardware: iPhone 6 (16GB)
Software: Firefox Focus (Newest @ 8.1.1 via "About Firefox Focus") running on iOS 12.1.2

Summary: After performing a search for "Term X" and fully closing the app or clearing data through native button, Term X is recoverable in a later session

Steps to Reproduce (see video attachment for context):

1. Open Firefox Focus app
2. Tap on the text input bar at the top of the page
3. Input "donotrecover" and execute search (Actual search term is arbitrary)
4. Click on a search result
5. Wait for the page for search result to load
6. Tap the native app "Back" button to navigate to the previous page
7. Wait for the search for "donotrecover" to reload
8. Tap the native app "Forward" button to return navigation to the search result we selected
9. Wait for page to load
10. Double press the "Home" button on your iOS device in rapid succession
11. "Flick" the Firefox Focus app off the top of the screen to close it
    //This process should clear all history and searches.
12. Open the Firefox Focus app
13. Tap on the text input bar at the top of the page
14. Input "jennifer aniston" and execute search (Actual search term is arbitrary)
15. Click on a search result
16. Wait for the page for search result to load
17. Tap the native app "Back" button to navigate to the previous page
18. When scrolling down the text bar at the top of the page collapses. When scrolling up the text bar reappears. Using one hand swipe up and down until you find the "sweet spot" where you can catch the text bar in a a middle-state where it appears slightly faded (see video attachment). Continue to hold the app in this scroll position with your first hand.
19. Slowly move you hand controlling the scroll position upward until the "Back navigation" button becomes visible
20. While keeping the first hand in place, rapidly tap the native navigate "Forward" and "Back" in an alternating order
21. Note that the search term "donotrecover" is populated into the text bar

Additional Details:
-Search results utilized are arbitrary, but some are harder to reproduce than others.
-Slow network conditions and large download sizes for search results make reproducing easier
-Using 2 hands to tap screen at same time is not necessary, just more consistent (anecdotally) in reproduction
-Text input box reads "donotrecover", but upon tapping to see actual URL shows a typical google search for "jennifer aniston".
-Recovery of search terms is not limited to n-1, I have achieved as far back as 4 x search-clear-searches
-Sometimes upon reproduction of bug the recovered search term is displayed in the text bar and the words "Frame Load Interrupted" are displayed in the browser window with a blue button containing the words "Try Again" located below it. Tapping "Trying again" has never resulted in any changes.
-Not reproducible in Firefox Focus Android. Upon performing a search the full search URL populates the text bar instead of a user friendly representation of what was typed.

Comment 1

[Matthew Remacle]

Attachment: Firefox_Focus_Bug.mp4

Comment 2

[Matthew Remacle]

(In reply to Matthew Remacle from comment #1)

Created attachment 9042358 [details]
Firefox_Focus_Bug.mp4

It looks like bugzilla is not a fan of MP4's. In the case that you you cannot download the video, here is a link to a streamable copy hosted on my OneDrive account.

https://1drv.ms/v/s!AugvYfruBTJqg8NbSf9uaupKGXDX3A

Comment 3

[Daniel Veditz [:dveditz]]

Misunderstood this as a "Firefox for iOS" bug (sorry, rushed triage meeting). Since the whole point of Focus is "private browsing" saving things to disk violates the whole point of the product.

Justin pointed to this PR where we do exactly that: https://github.com/mozilla-mobile/focus-ios/pull/1215

[Matthew: I could load the video just fine and it was helpful for this complicated set of steps. Thanks especially for the clear WRITTEN steps, too -- those are even more important.]

Comment 4

[Justin D'Arcangelo [:justindarc]]

ni? :sblatz who will likely be the engineer fixing this.

Comment 5

[Daniel Veditz [:dveditz]]

I guess sec-high overstates it from a security POV (it's a local, not remote, attack), but lowering it to sec-moderate doesn't mean it's not important.

Comment 6

[Sawyer Blatz [:sblatz]]

Patch submitted for review: https://github.com/mozilla-mobile/focus-ios/pull/1645

Comment 7

[Matthew Remacle]

Greatly appreciate the feedback on bug report. More than happy to attempt to reproduce after patch.

"I guess sec-high overstates it from a security POV (it's a local, not remote, attack), but lowering it to sec-moderate doesn't mean it's not important."

As much as I'd like to be on the Mozilla hall of fame with a sec-high bug due to this bug "violating the whole point of the product", i do agree with the above statement to it's severity.

For what it's worth: I did set up a server to feed test cases via server-sent-events in an attempt to abuse [window.history, localstorage, ...] in an attempt to reproduce remotely and found nothing over the past week. Good learning experience though; Such is life.

Very happy with the product overall and intend to run test cases of whatever I come up with against patched version upon release for a few days.

Comment 8

[Justin D'Arcangelo [:justindarc]]

(In reply to Matthew Remacle from comment #7)

For what it's worth: I did set up a server to feed test cases via server-sent-events in an attempt to abuse [window.history, localstorage, ...] in an attempt to reproduce remotely and found nothing over the past week. Good learning experience though; Such is life.

Yeah, fortunately this bug shouldn't affect anything inside the webview. The concern here is mainly that the last-entered search string is persisted in such a way that could be recovered from the data saved via an iTunes/iCloud backup. But as previously mentioned, the app should never, ever persist this data (as is the entire point of the app). In the meantime, tapping the trash can icon in the top-right corner of the screen before closing the app will guarantee that the data is erased. Once this patch lands, we'll ship an update to erase any previously-saved data and prevent anything from getting saved again in the future.

Thanks again for the super-detailed bug report. Seriously, I can't recall a time I've seen this detailed of a bug report from an end user, so thank you so much for the time and effort you put into it!

Cheers!

Comment 9

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Thank you very much for this report Matthew. We are currently testing a fix and we are hoping to roll out an update for Focus and Klar in the coming days. Due to the holidays in Canada and the US, it may not appear until later in the week.

The patch can be found at https://github.com/mozilla-mobile/focus-ios/pull/1645

Comment 10

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Attachment: GitHub Pull Request

Comment 11

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

The patch was reviewed by :justindarc on GitHub.

Comment 12

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

This shipped in both Focus and Klar 8.1.2.

Comment 13

[Daniel Veditz [:dveditz]]

Stefan: What information did you need from me?