1677285 - Blank Address Bar Spoof (also affect permission dialog)

Status: VERIFIED DUPLICATE of bug 1676311

(Fenix :: Toolbar, defect)

Description

[Irvan Kurniawan (:sourc7)]

Attachment: spoof.html

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36

Steps to reproduce:

This bug is similar to Bug 1521708 that has been fixed on Firefox for Desktop. But it still works on Firefox for Android.

1. Open attached file "spoof.html"
2. Click "Sign in with Google" button

Actual results:

Address bar show "Search or enter address"

Expected results:

Address bar show "about:blank"

Comment 1

[Irvan Kurniawan (:sourc7)]

Attachment: Screenshot_20201114_141311.png

Comment 2

[Irvan Kurniawan (:sourc7)]

Furthermore when I added Geolocation API to the about:blank window page, the permission dialog is show as "Allow to use your location?" (hiding the origin URL).

I've rewritten the spoof.html with the intention of mimicking Google Maps web page (that usually request user current location), so when user click "View on Google Maps" it will render Google Maps on <iframe> at about:blank page. After a seconds, the Geolocation API asked permissions with prompt "Allow to use your location?" (hiding the origin URL).

As the origin URL is hidden, user will likely tap "Allow" as Google Maps webpage usually asked the permission to detect current location.

Comment 3

[Irvan Kurniawan (:sourc7)]

Attachment: Screenshot_20201115_044023.jpg

Comment 4

[Irvan Kurniawan (:sourc7)]

Attachment: spoof-permission.html

Comment 5

[Irvan Kurniawan (:sourc7)]

Attachment: spoof-permission.html

Added title and ensure user to tap on permission dialog.

Comment 6

[Irvan Kurniawan (:sourc7)]

Previously I tested this works on Firefox for Android Nightly 201113 17:03 (Build #2015775439) (as reproduced on screenshot above)

Then after 5 days reporting this issue, I updated the Firefox to Android Nightly 201118 17:04 (Build #2015776395), I surprised the issue has been fixed (because Mozilla team usually discusses the fix on the reported ticket).

I confirm it still works on Firefox for Android 83.1.0 (Build #2015776403). So the fix is somewhere between Firefox for Android Nightly 201114 to 20118.

Comment 7

[Kevin Brosnan [Ex-Mozilla]]

Fixed by 1676311