1742421 - (CVE-2022-26383) Exit fullscreen after Window resizeBy() or resizeTo()

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, task)

Description

[Edgar Chen [:edgar]]

Split off from https://bugzilla.mozilla.org/show_bug.cgi?id=1740389#c7.

Comment 1

[Edgar Chen [:edgar]]

In each platform, if the popup window is in maximum sizemode and script tries to resize the window, the popup window would exit the maximum mode to resize, so I think it also makes sense that the fullscreen window exits fullscreen mode to resize for consistency.

Comment 2

[Edgar Chen [:edgar]]

Attachment: Bug 1742421 - Part 1: [widget/gtk] Exit fullscreen when changing sizemode;

Comment 3

[Edgar Chen [:edgar]]

Attachment: Bug 1742421 - Part 2: [widget/cocoa] Exit fullscreen when changing sizemode;

Depends on D133734

Comment 4

[Edgar Chen [:edgar]]

Hmm, I am still working on a patch for Windows platform, Windows platform behaves a bit different than others.

Comment 5

[Edgar Chen [:edgar]]

Attachment: Bug 1742421 - Part 3: [widget/windows] Exit fullscreen when changing sizemode;

Depends on D133735

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Status update - patch under review, need to address some comments

Comment 7

[Chris Martin [:cmartin]]

Attachment: Bug 1742421 - Part 3: [widget/windows] Exit fullscreen when changing sizemode;

Comment 8

[Edgar Chen [:edgar]]

Comment on attachment 9255216 [details]
Bug 1742421 - Part 1: [widget/gtk] Exit fullscreen when changing sizemode;

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Might be easy to know there are bugs around fullscreen and size mode change, but need to resize the window before the notification is shown and also need to resize the window to very wide to hide the fullscreen notification
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Should be easy to create
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely, the changes are straightforward and have been tested manually, we have a lot of fullscreen tests and will also add one in bug 1745915 for this change

Comment 9

[Tom Ritter [:tjr] (OOTO until mid-August)]

Comment on attachment 9255216 [details]
Bug 1742421 - Part 1: [widget/gtk] Exit fullscreen when changing sizemode;

Approved to land and request uplift

Comment 10

[Tom Ritter [:tjr] (OOTO until mid-August)]

Comment on attachment 9255217 [details]
Bug 1742421 - Part 2: [widget/cocoa] Exit fullscreen when changing sizemode;

Approved to land and request uplift

Comment 11

[Tom Ritter [:tjr] (OOTO until mid-August)]

Comment on attachment 9258481 [details]
Bug 1742421 - Part 3: [widget/windows] Exit fullscreen when changing sizemode;

Approved to land and request uplift

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Part 1: [widget/gtk] Exit fullscreen when changing sizemode; r=stransky
https://hg.mozilla.org/integration/autoland/rev/8131fb235ef4f52bec8f5fadc0f8f62d147ffd0c
https://hg.mozilla.org/mozilla-central/rev/8131fb235ef4

Part 2: [widget/cocoa] Exit fullscreen when changing sizemode; r=mac-reviewers,mstange
https://hg.mozilla.org/integration/autoland/rev/945f4f4097e41d287193b607b53f60e13b98f575
https://hg.mozilla.org/mozilla-central/rev/945f4f4097e4

Part 3: [widget/windows] Exit fullscreen when changing sizemode; r=mhowell,edgar
https://hg.mozilla.org/integration/autoland/rev/75ac5875c5e3d12ebb414650ccf53f48d8ee01a6
https://hg.mozilla.org/mozilla-central/rev/75ac5875c5e3

fix lint failures. r=fix
https://hg.mozilla.org/integration/autoland/rev/9dc5214f65960a5f0cf24d490c3fe90330ceb25f
https://hg.mozilla.org/mozilla-central/rev/9dc5214f6596

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 14

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Please nominate this for Beta & ESR approval when you get a chance.

Comment 15

[Edgar Chen [:edgar]]

Comment on attachment 9255216 [details]
Bug 1742421 - Part 1: [widget/gtk] Exit fullscreen when changing sizemode;

Beta/Release Uplift Approval Request

• User impact if declined: Fullscreen notification could be hidden if a page tries to resize the window during the fullscreen transition.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: 1. Visit test attached in https://bugzilla.mozilla.org/show_bug.cgi?id=1740389#c4

2. Click "Launch" button
3. Tap anywhere on the popup page

• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The risk should be low, the changes are straightforward and only affect when the sizemode changes during fullscreen.
  There are some refactoring on Windows platform but the changes are unlikely to cause regressions.
• String changes made/needed: None

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a sec-high bug.
• User impact if declined: Fullscreen notification could be hidden if a page tries to resize the window during the fullscreen transition.
• Fix Landed on Version: 97
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The risk should be low, the changes are straightforward and only affect when the sizemode changes during fullscreen.
  There are some refactoring on Windows platform but the changes are unlikely to cause regressions.

Comment 16

[Edgar Chen [:edgar]]

Comment on attachment 9255217 [details]
Bug 1742421 - Part 2: [widget/cocoa] Exit fullscreen when changing sizemode;

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a sec-high bug.
• User impact if declined: Fullscreen notification could be hidden if a page tries to resize the window during the fullscreen transition.
• Fix Landed on Version: 97
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The risk should be low, the changes are straightforward and only affect when the sizemode changes during fullscreen. There are some refactoring on Windows platform but the changes are unlikely to cause regressions.

Comment 17

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Per Slack discussion with Chris and Tom, this needs to bake another cycle before we uplift.

Comment 18

[Bogdan Maris, Desktop QA]

(In reply to Edgar Chen [:edgar] (away ~ 02/25) from comment #15)

• If yes, steps to reproduce: 1. Visit test attached in https://bugzilla.mozilla.org/show_bug.cgi?id=1740389#c4

2. Click "Launch" button
3. Tap anywhere on the popup page

I reproduced the issue using old Nightly build from 2021-11-22, verified using latest Nightly across platforms (Windows 10, macOS 11.6 and Ubuntu 18.04) that the window enters full screen and exits right away.
One thing I noticed is that the pop-up window does not resize to its original size, it covers all the screen and on Windows it it wider then the screen. Noticed that on other browsers that particular window resizes to its original size. Is this something we can be concerned about?

Comment 19

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Edgar is still away for a while.
Chris, you reviewed the patch on Windows widget side
Can you follow up with comment 18 please?

Comment 20

[Chris Martin [:cmartin]]

From my perspective, there isn't any exploit based on the behavior mentioned in Comment 18, which means that maybe we want to fix it, but it would be a lower-priority UX enhancement and not a sec bug.

But I don't think I'm qualified to really say that there aren't some security implications to it. Maybe I can rope Daniel Veditz in here and he might be able to say with some confidence whether or not this is a potential security issue?

Comment 21

[Daniel Veditz [:dveditz]]

That sure seems like a bug, but I also see that behavior in Firefox Release after I manually press ESC to leave fullscreen on this testcase. Doesn't seem to be a side-effect of this particular fix. We should file a spec-compliance/compatibility bug on it if there isn't one already, but I can't think of any benefit this would give an attacker. They could already resizeTo() themselves into this state without going through fullscreen.

Comment 22

[Bogdan Maris, Desktop QA]

Thanks, in that case I'll mark this as verified on 98.

Comment 23

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Comment on attachment 9255216 [details]
Bug 1742421 - Part 1: [widget/gtk] Exit fullscreen when changing sizemode;

Approved for 91.7esr.

Comment 24

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/e6a04254cc65
https://hg.mozilla.org/releases/mozilla-esr91/rev/f8c4d04f3a4e
https://hg.mozilla.org/releases/mozilla-esr91/rev/68810f0fb308

Comment 25

[Bogdan Maris, Desktop QA]

Also verified fixed on esr91 across platforms (Windows 10, Ubuntu 18.04 and macOS 11.6) using build https://treeherder.mozilla.org/jobs?repo=mozilla-esr91&revision=6214d2494910e47c3836379b9538f1b8cffc09ca from treeherder.

Comment 26

[Tom Ritter [:tjr] (OOTO until mid-August)]

Attachment: advisory.txt