1543202 - Keyboard shortcut highlights menu despite being consumed by web content

Status: REOPENED

(Core :: Widget: Cocoa, defect, P3)

Description

[:Atoll]

I was instructed by :dao to file this new bug from bug 1381951 comment 6, where we're allowing the menu to highlight as if it were activated even though the keystroke is captured by Javascript. I think that this bug is likely deeply intertwined with bug 1381951, but I don't know the Firefox macOS UX codebase. :dao, please revise or correct me as you see fit here.

—

There's a UX bug whether you choose to permit websites to override Preferences or not: the 'Firefox' menu title in the menu bar highlights blue briefly when the key is pressed, but then doesn't open the Preferences.

So it should either highlight blue and open prefs, or not highlight and not open prefs.

It would be very easy to set up a phishing site that looks like about:preferences and bind it to Cmd-, on a bunch of poor-quality websites, especially for entrapping expert users.

Comment 1

[:Gijs (he/him)]

Maybe Markus or :spohl can help explain what's responsible for the highlighting.

I'm not convinced this needs to stay sec-sensitive as the phishing risk should be taken care of by bug 1381951.

Comment 2

[:Atoll]

Apologies, I didn't realize this needed a sec- flag :(

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Well we need to wait reply events of all non-consumed events here? It might make the main process performance worse...

Comment 4

[Dão Gottwald [:dao]]

(In reply to :Gijs (he/him) from comment #1)

I'm not convinced this needs to stay sec-sensitive as the phishing risk should be taken care of by bug 1381951.

Bug 1381951 being fixed doesn't mean web content can't override shortcuts anymore, but just that it can't override that particular one.

Comment 5

[Stephen A Pohl [:spohl]]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Might be slow response) from comment #3)

Well we need to wait reply events of all non-consumed events here? It might make the main process performance worse...

You beat me to it, but yes, it looks like it. This is responsible for giving the visual feedback in the menu bar.

Comment 6

[:Gijs (he/him)]

Pretty sure this is still the case so we probably shouldn't close it.