1539757 - Tab prompt doesn't close when clicking cancel in some circumstances

Status: RESOLVED FIXED

(Toolkit :: UI Widgets, defect, P1)

Comment 1

[James Lee]

Btw, just letting know that I already tell about this issue to the site owner.

Comment 2

[James Lee]

It appears this is the problem when we load the script using svg with prompt box.

Comment 3

[James Lee]

PoC:

<svg onload=prompt(document.domain)>
<svg onload=prompt(document.domain)>

http://pwning.click/ffsvg.php

Comment 4

[James Lee]

I think this is just a bug rather than security issue.

Comment 5

[:Gijs (he/him)]

The tab prompt isn't closing correctly for some reason. I suspect bug 1512048...

Comment 6

[:Gijs (he/him)]

Tagging comment #0 as private because the site hasn't bothered fixing the trivial XSS hole...

Testcase: http://pwning.click/ffsvg.php

Comment 7

[:Gijs (he/him)]

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4b3fc8b9128035c63821078328c73fbc525d1950&tochange=6dd228164d427b7b247e59e7d9d0251206dea83d

I guess I get to deal with this...

Comment 8

[:Gijs (he/him)]

Attachment: Bug 1539757 - fix trying to initialize XBL bindings while the prompt is still hidden, r?bgrins

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/de24b08ddc37
fix trying to initialize XBL bindings while the prompt is still hidden, r=bgrins

Comment 10

[Andrei Ciure[:aciure]]

Backed out changeset de24b08ddc37 (bug 1539757) for causing browser_hidden_document_autofill.js, browser_httpauth.js, test_bug_627616.html to permafail

push that caused the backout: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=de24b08ddc37fd7d3fd29c6b893713d5657269e6

failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=de24b08ddc37fd7d3fd29c6b893713d5657269e6&selectedJob=237048782&searchStr=windows%2C10%2Cx64%2Cdebug%2Cmochitests%2Cwith%2Ce10s%2Ctest-windows10-64%2Fdebug-mochitest-browser-chrome-e10s-4%2Cm-e10s%28bc4%29

https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=de24b08ddc37fd7d3fd29c6b893713d5657269e6&selectedJob=237047750&searchStr=windows%2C10%2Cx64%2Casan%2Cmochitests%2Cwith%2Ce10s%2Ctest-windows10-64-asan%2Fopt-mochitest-browser-chrome-e10s-1%2Cm-e10s%28bc1%29

https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=de24b08ddc37fd7d3fd29c6b893713d5657269e6&selectedJob=237044446&searchStr=linux%2Cx64%2Cquantumrender%2Cdebug%2Cmochitests%2Cwith%2Ce10s%2Ctest-linux64-qr%2Fdebug-mochitest-e10s-15%2Cm-e10s%2815%29

https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=de24b08ddc37fd7d3fd29c6b893713d5657269e6&selectedJob=237046627&searchStr=windows%2C7%2Cdebug%2Cfirefox%2Cfunctional%2Ctests%2C%28remote%29%2Cwith%2Ce10s%2Ctest-windows7-32%2Fdebug-firefox-ui-functional-remote-e10s%2Cfxfn-r-e10s%28en-us%29

backout: https://hg.mozilla.org/integration/autoland/rev/12fa4d0520ad825314a552cdffb87297e8d83748

Comment 11

[Andrei Ciure[:aciure]]

more backout failures:

https://treeherder.mozilla.org/#/jobs?repo=autoland&fromchange=dc3b81670b01b95428ad7c361d586845185b4527&searchStr=linux%2Cdebug%2Ctest-linux32%2Fdebug-marionette-e10s%2C%28mn%29&selectedJob=237069471

https://treeherder.mozilla.org/#/jobs?repo=autoland&fromchange=dc3b81670b01b95428ad7c361d586845185b4527&searchStr=windows%2C7%2Cdebug%2Cweb%2Cplatform%2Ctests%2Cwith%2Ce10s%2Ctest-windows7-32%2Fdebug-web-platform-tests-wdspec-e10s-2%2Cw-e10s%28wd2%29&selectedJob=237069814

Comment 12

[:Gijs (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=56296ba1185e09d6191ebb6e3e42a83f659cfcd8

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7c9d92502ec9
fix trying to initialize XBL bindings while the prompt is still hidden, r=bgrins

Comment 14

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/7c9d92502ec9

Comment 15

[:Gijs (he/him)]

Comment on attachment 9054473 [details]
Bug 1539757 - fix trying to initialize XBL bindings while the prompt is still hidden, r?bgrins

Beta/Release Uplift Approval Request

• Feature/Bug causing the regression: Bug 1512048
• User impact if declined: Unclosable prompt dialogs
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a relatively small fix, with automated test coverage.
• String changes made/needed: nope

Comment 16

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9054473 [details]
Bug 1539757 - fix trying to initialize XBL bindings while the prompt is still hidden, r?bgrins

P1 regression on XUL widgets, small fix with tests, approved for 66 beta 8, thanks.

Comment 17

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a3b5dd595e17