1751759 - reCAPTCHA image grids are unexpectedly draggable in Firefox

Status: ASSIGNED

(Web Compatibility :: Site Reports, defect, P3)

Description

[Daniel Holbert [:dholbert]]

STR:

1. View some reCAPTCHA of the form "Select all squares with $FOO" for some $FOO. (https://www.google.com/recaptcha/api2/demo is one place where you can test this, though it doesn't always trigger the actual captcha)

2. Click on one of the squares and drag.

ACTUAL RESULTS:
In Firefox, this triggers an "image drag" operation.

EXPECTED RESULTS:
No dragging.

Proximally, reCAPTCHA avoids this (in Chrome and Safari) by styling these images with -webkit-user-drag: none, which of course is non-standard and not supported in Firefox.

.rc-image-tile-wrapper img{position:relative;-webkit-user-drag:none;

Source: https://www.gstatic.com/recaptcha/releases/TDBxTlSsKAUm3tSIa0fwIqNu/styles__ltr.css

If I remove that style in Chrome devtools, then I get ACTUAL RESULTS in Chrome as well.

As noted on https://caniuse.com/webkit-user-drag , the preferred standard alternative is the draggable="false" HTML attribute. If I swap that in (on all of the img elements -- there are 16), then I get EXPECTED RESULTS in Chrome again.

However, I still get ACTUAL RESULTS in Firefox, which I think is due to bug 1376369 (where we mishandle draggable when user-select:none is set, as it is here on an ancestor).

So I think we don't have a great workaround to suggest right now; nonetheless, I figured I'd go ahead and file this.

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: testcase 1 (saved/standaone version of actual reCAPTCHA, depending on nonstandard `-webkit-user-drag: none;`)

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: testcase 2 (now depending on standardized `draggable="false"` attribute)

Here's a demo of ideally what we would like for them to switch to (using draggable="false" instead of the non-standard -webkit-user-drag:none), though as noted above, this unfortunately doesn't improve things in Firefox right now because we hit bug 1376369.

Comment 3

[Raul Bucata]

Thanks, Daniel, I was able to reproduce the issue from your test case, following: https://bug1751759.bmoattachments.org/attachment.cgi?id=9260443, as https://www.google.com/recaptcha/api2/demo does not trigger an image CAPTCHA:

https://prnt.sc/72yI2fATEcdE

Tested with:

Browser / Version: Firefox Release 101.0.1 (64-bit)/ Firefox Nightly 103.0a1 (2022-06-22) (64-bit) /Chrome Version Version 103/0/5060.53 (Official Build) (64-bit)
Operating System: Windows 10 PRO x64

Notes:

1. Reproducible regardless of the status of ETP.
2. Reproducible on the latest build of Firefox Nightly and Release.
3. Works as expected using Chrome

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since nightly and release are affected, beta will likely be affected too.
$For more information, please visit auto_nag documentation.