1706933 - When sync removes a bookmark with a keyword based on data from another device, the keyword is not removed

Status: RESOLVED FIXED

(Firefox :: Sync, defect)

Description

[Václav Trpišovský]

Please note that while reproducing this bug involves Firefox on mobile and Cloud Services (FF Sync), the product exhibiting (and likely causing) unexpected behavior is Firefox on desktop. I did not test other platforms, you can edit the platorm to "all" if you reproduce the bug elsewhere. Also, while the bug is very minor (most users will not experience it by accident), it could be exploited by adware and browser hijackers, see below.

Steps to reproduce:

1. Start with a Firefox desktop and mobile installations, connected via Firefox Sync.
2. On desktop, create a bookmark, open its Properties window and assign an unused keyword to it.
3. Synchronize both devices together.
4. Delete the bookmark on mobile.
5. Synchronize again.
6. View the bookmark list on desktop and notice that the bookmark is gone. This is expected behavior.
7. Use the keyword in the address bar to access the bookmark: it still works. This is unexpected behavior.
8. To remove this annoyance, open another bookmark's properties, assign the keyword to it, save changes, remove the keyword and save changes again.

Expected behavior:

After the bookmark is deleted from another device, it will no longer be accessible via the keyword in the Awesome bar.

Suspected cause:

I have never seen a line of Firefox code in my life but I assume that the bug is caused by some "keyword cache" not getting updated on certain actions.

Security concern:

Annoying malware, such as adware, could hijack some common keywords at the start of search queries (such as "the" or "how") invisibly (without a bookmark or Search settings entry) and redirect the user to their own page (which could resemble Google's and initiate a phishing attack). This is why I have hidden this post for security reasons, I encourage more experienced Bugzilla users to challenge or overturn this decision, as well as assign the correct priority/severity.

Final comment:

PLEASE do not "solve" this bug by removing the keyword feature and the %s parameter, as they are a needlessly hidden, amazingly useful tool for creating custom "search engines" and similar "responsive bookmarks".

Comment 1

[:Gijs (he/him)]

(In reply to Václav Trpišovský from comment #0)

Thanks for the report.

Security concern:

Annoying malware, such as adware, could hijack some common keywords at the start of search queries (such as "the" or "how") invisibly (without a bookmark or Search settings entry) and redirect the user to their own page (which could resemble Google's and initiate a phishing attack).

If the attack vector is malware or adware that messes with your profile (ie that is already present on the machine and has write access to the profile directory), there are much worse things they could do (e.g. install an add-on that always returns custom content for their domain, exfiltrate password data, whatever), so I don't think this is a vector for this bug that we should worry about.

Comment 2

[Ciprian Georgiu, Desktop QA]

The issue is still reproducbile with current Firefox Release 105.0.3, latest RC 106.0 and Nightly 107.0a1. I've tested with Win 7 x64.

Comment 3

[Sammy Khamis [:skhamis]]

Attachment: Bug 1706933: When sync removes a bookmark with a keyword, should also remove the keyword if necessary r?markh,mak

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/98e43cc1fc90
When sync removes a bookmark with a keyword, should also remove the keyword if necessary r=mak,lina

Comment 5

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/98e43cc1fc90