1605108 - Denial of Service through address bar autocomplete

Status: VERIFIED FIXED

(Firefox :: Address Bar, defect, P2)

Description

[Evgeny Larin]

Attachment: firefox.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

1. Create new firefox profile on the Win 10 (or use already existed).
2. Copy a paste string to the the Address bar (without quotes)
   "firefox...................................................................................................."

It looks like that problem in the improper parsing of url when domain expected.

Best regards,
Evgeny

Actual results:

The borwser will not response.

Expected results:

Nothing should have happened. I tested this issue in Win 7 and Linux 64-bit version. These systems not affected.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:adw, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Drew Willcoxon :adw]

Reproduces on Nightly. Possibly related to bug 1603316, bug 1587867.

Comment 4

[Drew Willcoxon :adw]

(In reply to Evgeny Larin from comment #0)

Steps to reproduce:

1. Create new firefox profile on the Win 10 (or use already existed).
   ...
   I tested this issue in Win 7 and Linux 64-bit version. These systems not affected.

That's strange, I wouldn't expect this to depend on your OS. I can reproduce it on macOS.

Comment 5

[Drew Willcoxon :adw]

This is fixed by the patch in bug 1603316.

Comment 6

[Alexandru Trif, Desktop QA [:atrif]]

Reproduced the issue using Firefox 73.0a1 (20191219215202) on Windows 10x66 and STR from comment 0. Firefox not responding after pasting the string.
The issue is verified fixed with Firefox 74.0b4 (20200216164042) on Windows 10x64, macOS 10.15 and Ubuntu 16.04.