1672093 - css @media RFP + window/screen leaks

Status: REOPENED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Thorin [:thorin]]

Attachment: example

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

In bug 418986 , RFP returns various screen/window metrics as the inner window measurement. This patch also covered [some] css media queries

issue

On devices with a devicePixelRatio !== 1 (results will vary), entropy can be leaked by css and matchmedia queries, when min and max values differ

• screen: @media min-device-height (and min-device-width I assume)
• window: @media min-height (and min-width I assume)
• all the above using a binary method in matchmedia

example

In this example, my phone's devicePixelRatio (dPR) is approx 2.61. I have RFP enabled.

The two matchMedia results show that dPR is not 1, and depending on the actual dPR, the value returned will not be an integer and provides entropy. How much entropy is unknown, but it's not a boolean

The same can happen with pure css, where the result is e.g. 1799 instead of 1800 (so a true/false bit entropy)

possible solutions

When RFP = true, for pure css, and for matchMedia (for the above metrics)

• always round, so at worst it's only a binary entropy
• always return max values for min values. Would this cause breakage?
• always return an integer, rounded up (is that the same as the previous point?)

Comment 1

[Thorin [:thorin]]

also see bug 1607027 - maybe the answer lies in fixing the underlying devicePixelRatio (which also leaks under css @media and matchMedia)

Comment 2

[Thorin [:thorin]]

well, if you're adding blocks, don't forget the other one... bug 1607032 :)