1832195 - (CVE-2023-37204) Select Option Dropdown able to Overlap Fullscreen Notification Toast

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Irvan Kurniawan [:sourc7]]

Attachment: testcase.html

When trigger requestFullscreen and slowdown code on select option element, the select option dropdown still appear even the browser goes into fullscreen.

Tested on:

• Firefox Nightly 115.0a1 (2023-05-09) (64-bit) on KDE X11
• Firefox Nightly 115.0a1 (2023-05-09) (64-bit) on KDE Wayland

Steps to reproduce:

1. Visit attached testcase.html
2. Click "AAAAAAAAAAAAAAAAAAAAAAA..." on select option element
3. Select option dropdown overlap the fullscreen notification toast

Comment 1

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox Nightly on Wayland - Select Options Overlap Fullscreen Notification Toast.mp4

Comment 2

[Irvan Kurniawan [:sourc7]]

When running this on mozregression, I able to reproduce the select dropdown overlap after below pushlog:

13:49.60 INFO: Last good revision: 9c6c93f01c00b52b10e44257fca3fbdff9109e61
13:49.60 INFO: First bad revision: aa0f92939f44b845804b6d9ba69746d841c6bc49
13:49.60 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9c6c93f01c00b52b10e44257fca3fbdff9109e61&tochange=aa0f92939f44b845804b6d9ba69746d841c6bc49

Comment 3

[Andrew McCreight [:mccr8]]

Assuming I am understanding you correctly, I'm going to mark this as a regression from bug 1744288, as that is related to full screen.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1744288

:m_kato, since you are the author of the regressor, bug 1744288, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 5

[Tyson Smith [:tsmith]]

FWIW, I was unable to repro on Windows 11 or Ubuntu 22.04 (gnome wayland), mccr8 also tried MacOS (no repro). I don't have a KDE install to test with.

Comment 6

[Makoto Kato [:m_kato]]

Irvan, could you reproduce on Ubuntu 22.04 GNOME?

Comment 7

[Makoto Kato [:m_kato]]

I guess that z-index is same as full screen UI and dropdown. I think that this might be timing issue and this might occurs even if not landing bug 1744288.

Comment 8

[Makoto Kato [:m_kato]]

bug 1744288 changes that requestFullscreen dispatches DOMFullscreen:Request immediately. And select actor tries to open drop down list by mousedown. So select actor won't close drop down list by entering fullscreen.

I think that we use AsyncEventDispatcher instead to fix this.

Comment 9

[Irvan Kurniawan [:sourc7]]

(In reply to Makoto Kato [:m_kato] from comment #6)

Irvan, could you reproduce on Ubuntu 22.04 GNOME?

I able to reproduce this very reliably on KDE X11 and Wayland on 2 PC with different CPU and screen resolution. I also able to reproduce this on Firefox Nightly 115.0a1 (2023-05-10) (64-bit) on Windows 11 with full-screen-api.transition-duration.enter set to 0 0.

Comment 10

[Irvan Kurniawan [:sourc7]]

I'll (In reply to Makoto Kato [:m_kato] from comment #6)

Irvan, could you reproduce on Ubuntu 22.04 GNOME?

I haven't tried it on Ubuntu 22.04 GNOME, I'll try it soon.

Comment 11

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox Nightly on Windows 11 - Select Option Dropdown Overlap Fullscreen Toast.mp4

Comment 12

[Irvan Kurniawan [:sourc7]]

Alright, by raising the JS slowdown code calculatePrimes(1000, 1000) to calculatePrimes(1000, 11011100) I also able to reproduce the fullscreen overlap with Firefox default configuration (without changing full-screen-api.transition-duration.enter) on Windows 11.

Comment 13

[Makoto Kato [:m_kato]]

Thanks, Irvan. I make sense this issue (root cause is comment #8)

Comment 14

[Irvan Kurniawan [:sourc7]]

Attachment: testcase-transition.html

Comment 15

[Irvan Kurniawan [:sourc7]]

Attachment: Firefox on Windows 11 - Select Dropdown Overlap Fullscreen Transition Toast.mp4

Comment 17

[Makoto Kato [:m_kato]]

Attachment: new test case

This occurs on 102a1 (20220516215740) too. Although I can reproduce reporter case after landing bug 1744288, I can reproduce my test case that is modified version of bug 1832627 on old version (102a1 (20220516215740)).

Comment 18

[Irvan Kurniawan [:sourc7]]

(In reply to Makoto Kato [:m_kato] from comment #17)

Created attachment 9333828 [details]
new test case

This occurs on 102a1 (20220516215740) too. Although I can reproduce reporter case after landing bug 1744288, I can reproduce my test case that is modified version of bug 1832627 on old version (102a1 (20220516215740)).

On my testcase after only single click the select dropdown able to cover the fullscreen toast, so victim unable to see the toast at all, which is more severe, reliable, and straightforward.

On the new testcase it require double click, at the first click the full-screen notification toast is immediately visible to victim, the victim has been notified and will be suspicious here, it is very unlikely to be used for real-life spoof scenario. Also when I tried double-clicking fast it not able to cover the fullscreen toast.

Normally double clicking the select dropdown is able to overlap the fullscreen toast, it possible from long time ago (able to reproduce on Firefox 59.0a1 (2018-01-01) (64-bit) and earlier Firefox version also do)

Comment 19

[Makoto Kato [:m_kato]]

(In reply to Irvan Kurniawan (:sourc7) from comment #18)

(In reply to Makoto Kato [:m_kato] from comment #17)

Created attachment 9333828 [details]
new test case

This occurs on 102a1 (20220516215740) too. Although I can reproduce reporter case after landing bug 1744288, I can reproduce my test case that is modified version of bug 1832627 on old version (102a1 (20220516215740)).

On my testcase after only single click the select dropdown able to cover the fullscreen toast, so victim unable to see the toast at all, which is more severe, reliable, and straightforward.

Yes, but when showing full screen notification, I think we should show it on top most even if double click. I can fix our report issue, but I am looking for possible other case, and we need to consider more.

Comment 20

[Makoto Kato [:m_kato]]

Emilio, is there a way to change fullscreen notification (by fullscreen-and-pointerlock.inc.xhtml) order to topmost at force? When showing XUL's menu item by <select> element during fullscreen notification is shown at same time, XUL menu is topmost, not full screen notification.

Comment 21

[Makoto Kato [:m_kato]]

When writing sample HTML, Chrome/Blink's fullscreen notification order isn't topmost. dropdown by <select> is topmost, not fullscreen notification.

Comment 22

[Emilio Cobos Álvarez [:emilio]]

Not easily, the select menu is a native os widget. You'd need to turn the pointer lock warning into a <panel> or something like that.

Comment 23

[Daniel Veditz [:dveditz]]

This was filed within the collision window of its dupe and therefore eligible for a split bounty

Comment 24

[Makoto Kato [:m_kato]]

Attachment: Bug 1832195 - Don't fire full screen request immediately.

Comment 25

[Makoto Kato [:m_kato]]

Comment on attachment 9337670 [details]
Bug 1832195 - Don't fire full screen request immediately.

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Not easy. This changes event timing only. I don't think that this issue is full screen related issue.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: 111
• If not all supported branches, which bug introduced the flaw?: Bug 1744288
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: N/A
• How likely is this patch to cause regressions; how much testing does it need?: Low. automation test will cover about new regression test
• Is Android affected?: No

Comment 26

[Tom Ritter [:tjr]]

Comment on attachment 9337670 [details]
Bug 1832195 - Don't fire full screen request immediately.

Approved to request uplift and land

Comment 27

[Donal Meehan [:dmeehan]]

:m_kato next week is RC week for Fx115, the last beta build is tomorrow.
Will this land and have an uplift request before then?

Comment 28

[Makoto Kato [:m_kato]]

Comment on attachment 9337670 [details]
Bug 1832195 - Don't fire full screen request immediately.

Beta/Release Uplift Approval Request

• User impact if declined: fullscreen notification is overlapped by dropdown box.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Browse https://bugzilla.mozilla.org/attachment.cgi?id=9333117
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Low. back to previous event timing for fullscreen.
• String changes made/needed: N/A
• Is Android affected?: No

Comment 29

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Landed: https://hg.mozilla.org/integration/autoland/rev/55d4f8fe0d124e37fc86bb6f141a120971df2157

Backed out for causing failures in browser_fullscreen_exit_on_external_protocol.js:
https://hg.mozilla.org/integration/autoland/rev/69b307c902da19e6d641ac54f0b0b8a5d32db4c4

Push with failures
Failure log

[task 2023-06-22T06:55:07.824Z] 06:55:07     INFO - TEST-START | dom/base/test/fullscreen/browser_fullscreen_exit_on_external_protocol.js
[task 2023-06-22T06:55:07.841Z] 06:55:07     INFO - Entering setup bound 
[task 2023-06-22T06:55:07.879Z] 06:55:07     INFO - Leaving setup bound 
[task 2023-06-22T06:55:07.880Z] 06:55:07     INFO - Entering test bound setupMailHandler
[task 2023-06-22T06:55:07.893Z] 06:55:07     INFO - Leaving test bound setupMailHandler
[task 2023-06-22T06:55:07.894Z] 06:55:07     INFO - Entering test bound OpenExternalProtocolOnPendingFullscreen
[task 2023-06-22T06:55:08.562Z] 06:55:08     INFO - GECKO(3895) | JavaScript error: , line 0: TypeError: Fullscreen request aborted

...

[task 2023-06-22T06:59:10.044Z] 06:59:10     INFO - TEST-UNEXPECTED-FAIL | dom/base/test/fullscreen/browser_fullscreen_exit_on_external_protocol.js | Test timed out - 

Comment 30

[Makoto Kato [:m_kato]]

Attachment: Bug 1832195 - Update browser_fullscreen_exit_on_external_protocol.js. r=edgar

Due to previous fix, I need to update
browser_fullscreen_exit_on_external_protocol.js since internal fullscreen
event isn't dispatched before request is canceled.

Also, I add one more test for cancelling fullscreen during transition.

Comment 31

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Don't fire full screen request immediately. r=edgar
https://hg.mozilla.org/integration/autoland/rev/b7ae81cb82195ff07478e5474813e06d31b1563d
https://hg.mozilla.org/mozilla-central/rev/b7ae81cb8219

Update browser_fullscreen_exit_on_external_protocol.js. r=edgar
https://hg.mozilla.org/integration/autoland/rev/4e18d0854dc239939d0e1b448a6b51e20d6193d9
https://hg.mozilla.org/mozilla-central/rev/4e18d0854dc2

Comment 32

[Donal Meehan [:dmeehan]]

Comment on attachment 9337670 [details]
Bug 1832195 - Don't fire full screen request immediately.

115 is now in RC, moving uplift request to release

Comment 33

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:m_kato, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Comment 34

[Donal Meehan [:dmeehan]]

Clearing ni - we will uplift this for Fx115.0 RC2

Comment 35

[Bogdan Maris, Desktop Test Engineering]

Reproduced the initial issue using an old Nightly build from 2023-05-09 and the testcase provided, verified that using latest Nightly from today (2023-05-27/28) this is no longer an issue, I can see the same behavior as in Firefox esr102, the fullscreen notification if visible when entering fullscreen mode across platforms (Windows 10, Ubuntu 22.04 and macOS 13.2).

Comment 36

[Donal Meehan [:dmeehan]]

Comment on attachment 9337670 [details]
Bug 1832195 - Don't fire full screen request immediately.

Approved for 115.0 RC2

Comment 37

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-release/rev/09dbf21268ce
https://hg.mozilla.org/releases/mozilla-release/rev/29a69b8920c7

Comment 38

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr115/rev/b1e77f020f8a
https://hg.mozilla.org/releases/mozilla-esr115/rev/1493411a938a

Comment 39

[Bogdan Maris, Desktop Test Engineering]

(In reply to Bogdan Maris, Desktop QA from comment #35)

Reproduced the initial issue using an old Nightly build from 2023-05-09 and the testcase provided, verified that using latest Nightly from today (2023-05-27/28) this is no longer an issue, I can see the same behavior as in Firefox esr102, the fullscreen notification if visible when entering fullscreen mode across platforms (Windows 10, Ubuntu 22.04 and macOS 13.2).

Also verified on Firefox 115.0-build2 and 115.0esr-build2 on the same platforms as above.