1740389 - (CVE-2022-22741) Browser window is locked in fullscreen mode using window.resizeBy() or resizeTo()

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, task)

Description

[Irvan Kurniawan [:sourc7]]

Attachment: launcher-fullscreen.bundle.html

After invoke requestFullScreen in the popup window then move the popup window using moveBy or moveTo the browser goes into full screen with hidden fullscreen notification and moreover fullscreen mode won't exit even repeatedly press "esc" multiple times.

Tested on:

• Firefox Nightly 96.0a1 (2021-11-09) on Windows 11
• Firefox Release 94.0.1 on Windows 10 and Windows 11

Steps to reproduce:

1. Visit attached launcher-fullscreen.bundle.html
2. Click "Launch" button
3. Tap anywhere on the popup page
4. Browser goes into fullscreen with hidden fullscreen notification
5. Press "esc" multiple times to try exit the fullscreen mode
6. Browser still persist in fullscreen mode

Comment 1

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox - Hide Fullscreen Notification and Lock Fullscreen Mode with Window Move.mp4

Comment 2

[Irvan Kurniawan [:sourc7]]

Oh sorry typo, it should be resizeBy or resizeTo as on attached testcase.

Comment 3

[Daniel Veditz [:dveditz]]

Seems to not work on macOS or linux, fwiw. Confirmed by Tyson on Windows.

It is possible to "get out" by Alt-tab to the original non-popup browser window, but the fullscreen persists if you switch back to the popup.

Comment 4

[Irvan Kurniawan [:sourc7]]

Attachment: launcher-fullscreen.bundle2.html

(In reply to Daniel Veditz [:dveditz] from comment #3)

Seems to not work on macOS or linux, fwiw. Confirmed by Tyson on Windows.

Thanks Dan for the update, it turns out after removing document.write from the launcher-fullscreen.bundle.html, then testing this on Arch Linux and Ubuntu the fullscreen notification will also hidden, but press "esc" will exit the fullscreen mode.

It is possible to "get out" by Alt-tab to the original non-popup browser window, but the fullscreen persists if you switch back to the popup.

Yes, it only block the "esc" key which related to fullscreen code, other keyboard shortcut e.g. "ctrl+w" still works.

Comment 5

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Edgar said he is investigating.

Comment 6

[Edgar Chen [:edgar]]

(In reply to Irvan Kurniawan (:sourc7) from comment #4)

It is possible to "get out" by Alt-tab to the original non-popup browser window, but the fullscreen persists if you switch back to the popup.

Yes, it only block the "esc" key which related to fullscreen code, other keyboard shortcut e.g. "ctrl+w" still works.

This is a windows only bug, after calling window.resizeBy(), it seems window widget lose tracking of fullscreen state, so we early return in https://searchfox.org/mozilla-central/rev/702199bca53babc925e47fd8f86ed56487d42492/widget/windows/nsWindow.cpp#3655 when we tries to exit fullscreen trigger from "esc" key.

Comment 7

[Edgar Chen [:edgar]]

(In reply to Irvan Kurniawan (:sourc7) from comment #4)

(In reply to Daniel Veditz [:dveditz] from comment #3)

Seems to not work on macOS or linux, fwiw. Confirmed by Tyson on Windows.

Thanks Dan for the update, it turns out after removing document.write from the launcher-fullscreen.bundle.html, then testing this on Arch Linux and Ubuntu the fullscreen notification will also hidden, but press "esc" will exit the fullscreen mode.

This is another bug I think, it seems the warning is offset outside the viewport due to the window resize.
Chrome and safari exits fullscreen after window resize call, I think we should also follow them which is also good for compatibility.

Comment 8

[Edgar Chen [:edgar]]

(In reply to Edgar Chen [:edgar] from comment #7)

This is another bug I think, it seems the warning is offset outside the viewport due to the window resize.
Chrome and safari exits fullscreen after window resize call, I think we should also follow them which is also good for compatibility.

Split this out to bug 1742421.

Comment 9

[Edgar Chen [:edgar]]

Attachment: Bug 1740389;

Comment 10

[Edgar Chen [:edgar]]

Comment on attachment 9252103 [details]
Bug 1740389;

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Probably not so hard, patch shows the issue is something with size mode and fullscreen exit, but someone would need to find a way to change the size mode.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: None.
• How likely is this patch to cause regressions; how much testing does it need?: My sense is it's unlikely. The patch is reasonable and only affect the exit fullscreen call. The existing fullscreen automatic test + the test case attached in the bug might be enough.

Comment 11

[Tom Ritter [:tjr]]

Comment on attachment 9252103 [details]
Bug 1740389;

Approved to land and uplift

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=handyman
https://hg.mozilla.org/integration/autoland/rev/619831fc630d5d87058951cf21f9726970d26951
https://hg.mozilla.org/mozilla-central/rev/619831fc630d

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 14

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/4aa7b33c8c0e

Approved for 96.0b4

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/e5b99d030b20

Comment 16

[Edgar Chen [:edgar]]

(In reply to Release mgmt bot [:sylvestre / :calixte / :marco for bugbug] from comment #13)

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Done.

Comment 17

[Ciprian Georgiu, Desktop QA]

Reproduced the bug with STR from comment 0, on an affected Nightly build 95.0a1 (20211022213234).

The issue is verified as fixed on the latest builds: Nightly 97.0a1, Beta 96.0b4 and 91.5.0esr. Tested with Win 10 x64.

Comment 18

[Frederik Braun [:freddy]]

Attachment: advisory.txt