Phishing site using javascript to circumvent accessibility.blockautorefresh
Categories
(Core :: Widget: Gtk, defect)
Tracking
()
People
(Reporter: shill, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Steps to reproduce:
Saw this in a phishing attempt, so I will provide "redacted" URLs.
Go to hxxps://mon.fronlines.fr/
index.html consists of
<!DOCTYPE html>
<html>
<body>
<script>
var sites = ['hxxps://messagerie-portailas-vitale.appmanagere.com','hxxps://messagerie-portailas-vitale.appmanagere.com'];
window.location.replace(sites[Math.floor(Math.random()*sites.length)]);
</script>
</body>
</html>
Actual results:
Although accessibility.blockautorefresh is set to true, Firefox automatically redirects to hxxps://messagerie-portailas-vitale.appmanagere.com/ on load.
Expected results:
Related bugs:
Bug 220118
Bug 520431
One more data point:
Upgraded to FF 97
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0
Created a fresh profile
Set accessibility.blockautorefresh to true in about:config
hxxps://mon.fronlines.fr/ still redirects automatically.
Bug 1681447 might be related as well.
|
||
Comment 3•4 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.
Yes, I think the bot is wrong. this report has got nothing to do with GTK, it's the Javascript API.
Maybe we could ignore window.location.replace() when accessibility.blockautorefresh is true?
Description
•