1693212 - getClientRects plus CSS Animation can synthesize a RAF-interval-resolution timing probe

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Kelsey Gilbert [:jgilbert]]

Attachment: css-animation-timer.html

Here's a proof-of-concept for using a CSS Animation with getClientRects to synthesize a timestamp at better resolution than our RFP 100ms truncate mitigation should allow.

This is related to an idea I had in bug 1692609 to use RAF interval as our truncation granularity for RFP.

Maybe this doesn't warrant being a sec bug, but it's a subversion of our timer mitigations.

tjr: If this can be public we can open it up. Up to you!

Comment 1

[Kelsey Gilbert [:jgilbert]]

Oops, I guess I missed adding the needinfo!

Comment 2

[Kelsey Gilbert [:jgilbert]]

From some of the comments elsewhere, it sounds like we chosen to deliberately not mitigated this, which is fine. (this problem sort of goes away with the 60hz-time-atom patch in bug 1692609)

Comment 3

[Georg Koppen]

FWIW, I am fine with opening that up (if that is the question).

Comment 4

[Thorin [:thorin]]

I think we can close this, yes?

Comment 5

[Tom Ritter [:tjr] (OOTO until April)]

Thanks!