1574956 - Form filling not isolated between regular and private windows

Status: RESOLVED INVALID

(Firefox :: Session Restore, defect)

Description

[Honza Bambas (:mayhemer)]

Extracted from:
https://bugzilla.mozilla.org/show_bug.cgi?id=1564457#c0

STR:

• in a regular window go to http://lucb1e.com/rp/cookielesscookies/
• under the Want to store some text here? type a text
• in a private window (same browser session) go to http://lucb1e.com/rp/cookielesscookies/

AR:

• the filed (text area) is filled with the text

ER:

• the filed (text area) is empty

Not sure if this is a duplicate or this is how we should behave (IMO, we should not).

Comment 1

[(no longer active)]

This seems to be a bug in the toolkit sessionstore code. When collecting form data, we only capture the form data + the URL of the document, and do not take the private browsing state into account. However we should look at the private browsing state of the window we're collecting from as well, and when we see data that has come from a private window, we shouldn't restore it in a non-private window and vice/versa. Plus, we shouldn't persist the private browsing window data to disk.

Alphan, do you think this is something you could pick up? I was looking at the code around this and saw that you've been working on this code very recently (e.g. in bug 1544371). Thanks!

Comment 2

[Alphan Chen [:alchen]]

I am not sure if this is a bug of sessionStore.

(In reply to Honza Bambas (:mayhemer) from comment #0)

STR:

• in a regular window go to http://lucb1e.com/rp/cookielesscookies/
• under the Want to store some text here? type a text
  We also need to press "store button" to reproduce the symptom.

If it is related to sessionStore, we don't need to press "store button".
I will double confirm the sessionStore code later.

Comment 3

[Alphan Chen [:alchen]]

I confirmed that it is not related to sessionStore.

After entering some random words(e.g. "test test test test") in the original window, I open a private window and see the random words.
Those words are not filled by sessionStore. The page is generated with those words. (see below)
I will consider that it is a bug related to fingerprinting.

[source]
<form method="POST" action="./">
<b>Number of visits:</b> 4<br/>
<br/>
<b>Last visit:</b> Tue, 20 Aug 2019 12:50:22 +0000<br/>
<br/>
<b>Want to store some text here?</b><br/>
<textarea name=newstring style="width: 632px;" rows=4>test test test test</textarea><br/>
(max. 350 characters)<br/>
<input type=submit value=Store />
</form>
<br/>

Comment 4

[Honza Bambas (:mayhemer)]

Ah, thanks! So this is sent to us by the server, using the same server-fullstate backend. It's just [UA+publicIP] tracking, nothing more.

Thank you and sorry for wasting your time with this!

INVALID.

Comment 5

[(no longer active)]

Yes indeed. Let's stop looking at this website as a test case. ;-)