1743329 - (CVE-2024-6608) requestPointerLock on iFrame src from different origin able to move the cursor out of viewport

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Irvan Kurniawan [:sourc7]]

Attachment: rpl-geolocation-windows.html

After invoke requestPointerLock on iframe src from different origin, surprisingly on Fission enabled the cursor or pointer will move outside viewport including to toolbar, permission panel, desktop, taskbar, and more.

On the attached testcase I able to move user pointer to "Allow" button on permission panel, so when user double click the box, user will unaware it also click "Allow" button to allow Geolocation permission.

Tested on:

• Firefox Nightly 96.0a1 (2021-11-28) (64-bit) on Windows 11 (with screen resolution 1920x1080)
• Firefox Nightly 96.0a1 (2021-11-28) (64-bit) on Arch Linux (with screen resolution 2560x1440)

Steps to reproduce:

1. Visit attached rpl-geolocation-windows.html
2. Click "Launch" button
3. Double click the box
4. Geolocation permission is now allowed

Comment 1

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox - requestPointerLock from iframe different origin move pointer out of viewport.mp4

Comment 2

[Irvan Kurniawan [:sourc7]]

Attachment: rpl-dragdropsteal-windows.html

Here I demonstrate I can move the cursor to the desktop, after second click the cursor will drag (steal) the desktop file back to the pointerlock area.

If dragged file is Windows shortcut .lnk by using Link Parser software it can reveal more information such as LinkCreationDate, VolumeSerialNumber, VolumeLabel, LocalBasePath, NetBIOS (Hostname), MAC Address, and more.

Steps to reproduce:

1. Visit attached rpl-dragdropsteal-windows.html
2. Resize the browser window (so that the left corner desktop shortcut is visible)
3. Click Launch
4. Double click the box
5. File or folder in the desktop will dragged back to iFrame pointerlock area.

Comment 3

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox - requestPointerLock Drag and Drop Steal.mp4

Comment 4

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

We could also see this without Fission if the window is small enough, but it is much worse on Fission.

so there are two things here,

1. In the current implementation, we will try to reset the mouse position to the center position of the requesting process (via synthesizing a native mousemove event), but somehow the center position of the OOP iframe is over the notification popup, which is super weird.
2. Once the mouse position is outside the web content, we are unable to reset its position to "lock" mouse in a specific element.

I think we need to check 1 first, it is a Fission-specific issue.
For 2, it is a known bug, https://bugzilla.mozilla.org/show_bug.cgi?id=853160#c13 might be a proper solution.

Comment 5

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

(In reply to Edgar Chen [:edgar] from comment #4)

2. Once the mouse position is outside the web content, we are unable to reset its position to "lock" mouse in a specific element.

As a quick alternative, we could also try to set the capture content to the XULFrame in the parent document or just always redirect the mouse event to web content when pointer lock is active.

Comment 6

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

Bug 1255338 is a more generic change which should also fix this.

Comment 7

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

(In reply to Edgar Chen [:edgar] from comment #5)

As a quick alternative, we could also try to set the capture content to the XULFrame in the parent document or just always redirect the mouse event to web content when pointer lock is active.

On a second thought, when the permission panel (or other popup) is opened, user might expect to be able to interact with the panel. Additionally, users don't have a way to exit pointer lock without closing the popup. So I think exiting the pointer lock automatically when popup is opened has a better UX.

Comment 8

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

Attachment: WIP: Bug 1743329 - Use nsMenuPopupFrame in GetVisiblePopups();

Comment 9

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

Attachment: Bug 1743329 - Use nsMenuPopupFrame in GetVisiblePopups();

Comment 10

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

Attachment: Bug 1743329 - Release pointer lock when xul popup is open;

Comment 11

[Edgar Chen [:edgar] (PTO 2/2 ~ 2/6)]

Attachment: Bug 1743329 - Handle ESC key to release pointer lock in parent process;

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/209a41c449e1
Use nsMenuPopupFrame in GetVisiblePopups(); r=smaug
https://hg.mozilla.org/integration/autoland/rev/cd96c48488eb
Release pointer lock when xul popup is open; r=smaug
https://hg.mozilla.org/integration/autoland/rev/0f9bffa357a5
Handle ESC key to release pointer lock in parent process; r=smaug
https://hg.mozilla.org/integration/autoland/rev/6d33ea38cd14
apply code formatting via Lando

Comment 13

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/405be8bb745b
Backed out 4 changesets for causing failures at browser_popupNotification_security_delay.js. CLOSED TREE

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Push with failures
Failure log

[task 2024-05-29T12:09:22.700Z] 12:09:22     INFO - TEST-PASS | browser/base/content/test/popupNotifications/browser_popupNotification_security_delay.js | Notification should still be open because we clicked during the security delay. - 
[task 2024-05-29T12:09:22.700Z] 12:09:22     INFO - Wait for security delay to expire.
[task 2024-05-29T12:09:28.200Z] 12:09:28     INFO - Run test specific actions which restarts the security delay.
[task 2024-05-29T12:09:28.201Z] 12:09:28     INFO - Enter pointer lock
[task 2024-05-29T12:09:28.224Z] 12:09:28     INFO - Console message: [JavaScript Warning: "Request for pointer lock was denied because the browser failed to lock the pointer." {file: "https://example.com/" line: 0}]
[task 2024-05-29T12:09:55.318Z] 12:09:55     INFO - TEST-INFO | started process screentopng
[task 2024-05-29T12:09:55.519Z] 12:09:55     INFO - TEST-INFO | screentopng: exit 0
[task 2024-05-29T12:09:55.520Z] 12:09:55     INFO - TEST-UNEXPECTED-FAIL | browser/base/content/test/popupNotifications/browser_popupNotification_security_delay.js | Test timed out - 

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/809b1444b032
Use nsMenuPopupFrame in GetVisiblePopups(); r=smaug
https://hg.mozilla.org/integration/autoland/rev/42fb9a1a6ff8
Release pointer lock when xul popup is open; r=smaug,pbz
https://hg.mozilla.org/integration/autoland/rev/8d5d56cea3b8
Handle ESC key to release pointer lock in parent process; r=smaug

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/809b1444b032
https://hg.mozilla.org/mozilla-central/rev/42fb9a1a6ff8
https://hg.mozilla.org/mozilla-central/rev/8d5d56cea3b8

Comment 17

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 18

[Simon Friedberger [:simonf]]

Attachment: advisory.txt