1581592 - Lebowskilebowski bug while accessing US Department of State website

Status: RESOLVED INVALID

(Web Compatibility :: Site Reports, defect)

Description

[andreareboracom]

Attachment: Bug Report (US DoS lebowskilebowski).pdf

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

Steps to Reproduce (please see PDF attached for screenshots)

1. Visit https://dvlottery.state.gov/
2. Before the official page shows up, the “lebowskilebowski bug” appears.
3. The bug cannot be replicated with, for instance, Microsoft Edge. The version of my browser is 68.0.2 (64-bit)

Actual results:

Before the official page at https://dvlottery.state.gov/ shows up, the “lebowskilebowski bug” appears.

Expected results:

When requesting this website (https://dvlottery.state.gov/), the user should be redirected immediately to the official page.

Comment 1

[Liz Henry (:lizzard)]

This should have been fixed in 67 in bug 377496. Andrei, can your team try and reproduce the bug?
johann, can you take a look too?

Comment 2

[Johann Hofmann [:johannh]]

What is a lebowskilebowski bug? I have no idea what this is about and how it's related to bug 377496.

Comment 3

[Cristian Baica [:cbaica], Release Desktop QA]

From what I've read, it's some kind of js injection that's done in Fx and for a brief time, an input box is displayed and below it the text 'lebowskilebowski' is displayed. This is what I've found on stack overflow about it.

Investigating this, on multiple machines, I haven't manage to reproduce the reported issue using the provided link. What is to be noted though is that before the website is loaded, there is a slight pause on a blank page, but nothing is displayed either on screen or in the devtools inspector.

While this is the case, please note that the issue could be reproduced by accessing ceac.state.gov as it's connected it seems to an issue reported on mobile: https://github.com/Modernizr/Modernizr/issues/1052.
Using ceac.state.gov, the issue could be reproduced on the latest RC(Fx69), beta(Fx70.0b7) and nightly(Fx71.0a1) versions.

Comment 4

[Cristian Baica [:cbaica], Release Desktop QA]

Attachment: lebowski bug

Comment 5

[Liz Henry (:lizzard)]

I'm able to see it as well - just tried in 71 on ceac.state.gov in a private window. Johann, does that help?

Comment 6

[Johann Hofmann [:johannh]]

I'm sorry, I'm completely lost. This seems like an issue with Modernizr then, what does bug 377496 have to do with it?

Comment 7

[Liz Henry (:lizzard)]

Supposedly bug 377496 fixed the issue. And, I thought maybe it's our bug because it doesn't show up in other browers. I can go report it in https://github.com/modernizr/modernizr/issues and we can close this bug if you think that makes sense.

Comment 8

[Liz Henry (:lizzard)]

Cristian does this show up in Chrome or Safari? If it doesn't then maybe we should still be looking into how to protect against this sort of issue.

Comment 9

[Cristian Baica [:cbaica], Release Desktop QA]

Additional testing done using Chrome, Safari and Microsoft Edge.
The bug does not appear in any other browser, on either of the mentioned addresses (ceac or dvlottery).

What is to be noted though is that on Chrome, for ceac.state.gov, there is a window requiring the user to input an image displayed code (as seen here).

Comment 10

[Johann Hofmann [:johannh]]

Sounds like a web compat issue.

Comment 11

[Mike Taylor [:miketaylr]]

I don't think this issue is valid anymore, I don't see it as described.