1804816 - Css Draw Mouse Cursor 32x32 (zoom out) to hide omni box

Status: REOPENED

(Core :: DOM: CSS Object Model, defect)

Description

[Hafiizh]

Attachment: bandicam 2022-12-09 10-41-18-873.mp4

when the mouse drawing cursor at 32x32 and zoom out the web page less than 90% , it should be able to bust out of the web content area and can hide omnibox . maybe it could be more useful to an attacker if the cursor image was a spoofed URL

1. open https://cr.kungfoo.net/style/cursor/abusive-cursor.html
2. Zoom out the web page less than 90% ( i used 70%)
3. move cursor to hide omnibox

i attached the POC video

Comment 1

[Hafiizh]

on steps 3 : move cursor on yellow box then move to omnibox

I used Firefox : 107.0.1 (64-bit) Windows OS version

Comment 2

[Emilio Cobos Álvarez (:emilio)]

This seems intentional? We don't block 32x32 or smaller cursors at all, see the code. This is customizable by layout.cursor.block.max-size.

Comment 3

[Daniel Veditz [:dveditz]]

We've had similar problems with this testcase multiple times, and they're usually related to zoom in some way. I filed one on mac a long while ago that ended up being because of my system scaling setting. IN this case it's the FIrefox page zoom. They're all really kind of the same, although maybe we'd need to look at different places of possible scaling factors.

"hiding" the awesomebar doesn't seem possible or practical. 32x32 doesn't cover much, and the user isn't going to hold still so you can put some spoof content on it.

The "offset pointer" trick might work, but you don't have a lot of room to work with since you do have to draw your fake pointer in part of that box

Comment 4

[Emilio Cobos Álvarez (:emilio)]

I think this is WONTFIX (as in, working as expected). If we wanted to block smaller cursors we could just flip layout.cursor.block.max-size to zero, but when developing this that was deemed not an issue.

Comment 5

[Hafiizh]

i think https://bugzilla.mozilla.org/show_bug.cgi?id=1866300 and https://bugzilla.mozilla.org/show_bug.cgi?id=1864476

Comment 6

[Hafiizh]

i think https://bugzilla.mozilla.org/show_bug.cgi?id=1866300 and https://bugzilla.mozilla.org/show_bug.cgi?id=1864476 same as this bug

Comment 9

[Daniel Veditz [:dveditz]]

GIven that the addressbar is only 40px high I wouldn't mind lowering the size limit to 16px (simple pref change), or limiting a 32x32px cursor to only bleed over half its size (the same 16px) before reverting to the real pointer (a code change). We should keep talking to Google folks to see if they've seen anything that has made them reconsider the size limit.