1577852 - Middle-clicking on deviantArt navigates current tab in Firefox but not Chrome with flipping "beacon.enabled" to false

Status: UNCONFIRMED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Stephan Sokolow]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

1. Visit any deviation page on deviantArt, such as https://www.deviantart.com/boldfrontiers/art/Bald-River-Profile-Falls-811494192
2. Scroll to the "Se more by ..." section
3. Middle-click an image

Actual results:

The current tab navigates to the new image AND a new tab loads it as well.

Expected results:

The current tab stays unchanged and a new tab loads the linked-to image, as it did when I opened the page in Chrome OR when I use Ctrl+LeftClick rather than MiddleClick in Firefox.

Comment 1

[Sebastian Padilla]

Hi Stephan,

I'm very sorry for the delay in answering you. I was unable to reproduce this issue on Ubuntu 16.04 with Firefox Nightly 71, but maybe you can provide me with a bit more info.

Does this issue occur with a fresh profile? you can find the steps here: https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles?redirectlocale=en-US&redirectslug=Managing-profiles#w_starting-the-profile-manager

Can you please download Firefox Nightly from here: https://nightly.mozilla.org/ and retest the problem and see if the issue still occurs there as well?

If after doing this you can still reproduce the bug, could you send me a screenshot or a video of the bug? That always helps a lot.

Thanks in advance,

Best wishes!

Sebastian.

Comment 2

[Stephan Sokolow]

Ugh. It's something in my profile, but not something easy to narrow down.

Current version or nightly, it doesn't occur on a fresh profile or a reset profile, but does occur on a profile where I've deleted all extensions, switched to "always run in private browsing mode", manually deleted a whole bunch of saved state, and even tried safe mode.

My next suspicion is that it's one of my about:config settings. I'll get back to you on that.

Comment 3

[Stephan Sokolow]

OK, I've got a reproducer.

1. Install Nightly
2. Create a fresh profile
3. Go into about:config and toggle beacon.enabled to false
4. Load deviantart.com (or reload it, if you loaded it before toggling beacon.enabled)
5. Middle-click any piece of art
6. Go back to the front page
7. Ctrl+Click any piece of art for comparison

So the question is, why is deviantArt being allowed to override the behaviour of MiddleClick while Ctrl+LeftClick continues to function as MiddleClick used to?

I know Chrome had/has a bug where middle-clicks would get caught by left-click handlers while Firefox wouldn't allow sites to accidentally override middle-clicking. Is this a regression?

...and, if it's not a regression (which I dearly hope it is), then what non-touchpad-user added this abusable feature to middle-click while leaving Ctrl+Click tied exclusively to the browser's built-in behaviour?

Comment 4

[Sebastian Padilla]

Hi Stephan:

Thank you so much for the repro steps, they were very helpful. As I see, this is happening because the "beacon.enabled" is being changed, so I want us to try one more thing so we can know what to do.

If you can, please create a new profile and load all your profile settings to it (this is done very easily, I'll leave you a link with easy to follow steps to do it: https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles).

Please check if this is still happening when doing this.

I will also add a component so we can have any useful input from our devs.

Best wishes!

Sebastian

Comment 5

[Stephan Sokolow]

If you can, please create a new profile and load all your profile settings to it (this is done very easily, I'll leave you a link with easy to follow steps to do it: https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles).

To what end? What would that tell you that isn't already known from my reproduction steps? (I'm honestly curious.)

Also, Would that be fundamentally different from making a copy of my profile and then deleting everything but prefs.js? ...because I did that as part of narrowing down the cause.

Comment 6

[Sebastian Padilla]

Hi Stephan:

Thanks for writing back to us!

Well, actually it would tell us exactly if the issue is because of the settings of your profile. As you told us, you've changed the "beacon.enabled" from "true" (which is as it comes by default) to "false", making your profile one with a distinct setting and maybe that's the issue.

In any case, the issue has now a component so a dev can check it and give us more info.

Best wishes!

Sebastian

Comment 7

[Stephan Sokolow]

I produced the reproducer through the following process, which I'd think should be enough:

1. Pare down a copy of my profile until a change stops the problem from happening
2. Create a new copy of the profile and make just that change to see if the problem stops happening
3. Create a fresh profile and change just that one thing to see if it causes the problem.

I'd think that would be enough.

Comment 8

[Stephan Sokolow]

Ugh. ...and, having woken up recently, I was so impulsive that I clearly didn't re-read that to see I said the same thing twice.

Comment 9

[IcePanther]

This is bugging me since a long time, I finally found this bug and found a solution to my problem.

This also happens to me, and I can confirm that beacon.enabled set to false triggers the problem, resetting to true makes the problem go away (but exposes to a privacy risk).

When middle-clicking a picture :

• With beacon enabled : I see a (blocked by uBlock origin) beacon request, and the link (correctly) opens in a new tab only.
• With beacon disabled : I don't see any beacon requests (the tracking that beacons falls back to an tracker image, that I had to manually block in uBo, by the way ; bad frog.wix.com !) and the link incorrectly opens in the current tab in addition to the current tab.

(Interestingly, the problem occurs only if beacon is disabled when the "parent" page gets loaded, if I disable it after load, no problem. So I guess their JS somehow handles the way Firefox disables the beacon API badly on load, and then falls back to a buggy mode.)

Still, there must be a bug somewhere in the disabling of the beacon API ?

Maybe instead of disabling it altogether and making JS error out, just don't send the requests when this parameter is off ? So that it's invisible to JS that it's disabled, which has two advantages :

• no more of this bug,
• more generally, it would be a privacy advantage. As I explained above, when beacons are disabled the tracking script falls back on image tracking, which is harder to catch; making it believe that the beacon was sent, effectively would disable this tracker. I doubt that's the only tracker working this way, so this would be a privacy improvement.

Comment 10

[hovnocuc]

I'm experiencing this on the page https://www.seznamzpravy.cz/

Click on the link of the main article with using middle button and it will open new tab and switch to it immediately. When using context menu and clicking "Open link in a new tab", this is not happening. Tried with disabled beacon and fresh profile and still the same result. I have firefox 89.0 on linux.

Comment 11

[Stephan Sokolow]

(In reply to hovnocuc from comment #10)

I'm experiencing this on the page https://www.seznamzpravy.cz/

Click on the link of the main article with using middle button and it will open new tab and switch to it immediately. When using context menu and clicking "Open link in a new tab", this is not happening. Tried with disabled beacon and fresh profile and still the same result. I have firefox 89.0 on linux.

If changing the beacon setting doesn't alter the behaviour, then it's not the same thing. Your site probably just binds its custom JavaScript to mousedown or mouseup instead of click, bypassing Firefox's "apply the default behaviour on middle-clicking instead of emitting a click event".