1580506 - (CVE-2019-11754) Pointer Lock warning is no longer shown

Status: VERIFIED FIXED

(Firefox :: Security, defect, P1)

Description

[Johann Hofmann [:johannh]]

[Tracking Requested - why for this release]:
Critical security UI not showing up. Would be great to get this as a dot-release ride-along at least.

STR: Go to https://permission.site/ and click on "pointer lock". You should see a huge warning showing up that the website has taken control of your cursor and you can get it back, but it doesn't show up.

This was regressed by bug 1533948. Neil, can you please take a look at this bug?

Comment 1

[Johann Hofmann [:johannh]]

Based on this simple search it looks to me like we have not a single test covering the warning UI...

Comment 2

[Neil Deakin]

Attachment: Bug 1580506, fix incorrect pointerlock message names, r=gijs

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/autoland/rev/f779d14e3ab8

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for ES Lint failure on browser_pointerlock_warning.js:

https://hg.mozilla.org/integration/autoland/rev/733f2bf6c3530bbb983b6d1e4e972f1262fbf278

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&resultStatus=testfailed%2Cbusted%2Cexception%2Cusercancel%2Cretry%2Csuperseded&revision=f779d14e3ab8bb8b31a29601e9391775babbc2da
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=266304686&repo=autoland

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Fixed up and confirmed green:
https://hg.mozilla.org/integration/autoland/rev/f7ffb2b1b24f

Neil, can you please request Beta and Release approval on this? Thanks in advance!

Comment 6

[Neil Deakin]

Comment on attachment 9092176 [details]
Bug 1580506, fix incorrect pointerlock message names, r=gijs

Beta/Release Uplift Approval Request

• User impact if declined: When pointer lock is enabled by a website (requestPointerLock()) no warning appears. The mouse pointer disappears and the user may wonder why.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): None. Typo in source files.
• String changes made/needed: None

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9092176 [details]
Bug 1580506, fix incorrect pointerlock message names, r=gijs

Let's get this into beta 6.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/bb9376d19d797edfc469a59d7398bdb0e891c81a

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/f7ffb2b1b24fcefac4465f58bf5a5d8c7a8f78da
https://hg.mozilla.org/mozilla-central/rev/f7ffb2b1b24f

Comment 10

[Rares Doghi, Desktop QA]

Hi This issue is verified as Fixed in our latest Nightly build 71.0a1 (2019-09-15) as well as Beta 70.0b6 on windows 10, Mac osX 10.14 and Ubuntu 16.04.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9092176 [details]
Bug 1580506, fix incorrect pointerlock message names, r=gijs

Fixes a regression in Fx69 causing the warning to not be displayed when a website takes control of the mouse pointer. Approved for 69.0.1.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/bf6ea738ba07

Comment 13

[Rares Doghi, Desktop QA]

This issue is verified as fixed in 69.0.1 on Windows 10, Mac Osx 10.14 and Ubuntu 16.04.

Comment 14

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This bug has been identified as part of a pilot on determining root causes of blocking and dot release drivers.

It needs a root-cause set for it. Please see the list at https://docs.google.com/document/d/1FFEGsmoU8T0N8R9kk-MXWptOPtXXXRRIe4vQo3_HgMw/.

Add the root cause as a whiteboard tag in the form [rca - <cause> ] and remove the rca-needed keyword.

If you have questions, please contact :tmaity.

Comment 15

[Johann Hofmann [:johannh]]

Again, this is clearly both a Coding and a Testing Error. I'll take the first.