1843046 - (CVE-2023-4580) push notifications saved to disk in Private Browsing mode (Toggle off push notifications in Private Browsing mode)

Status: VERIFIED FIXED

(Core :: DOM: Push Subscriptions, defect, P2)

Description

[Harveer Singh]

As it has surfaced here (https://bugzilla.mozilla.org/show_bug.cgi?id=1823752), notifications store is not encrypted on disk in private browsing mode and it could leak sensitive information. There would be a follow up bug to properly encrypt and lifetime notifications store but for now, we want to disable notifications in PBM.

Comment 1

[Daniel Veditz [:dveditz]]

The original bug was describing two security problems that could be solved independently, so I'm turning this task bug into one of those security problems. (expiring old notifications might solve the unbounded growth in the other bug, but wouldn't solve this privacy issue)

Comment 2

[Harveer Singh]

Attachment: Bug 1843046: Do not allow notifications in private window.r=#dom-storage-reviewers

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b21c8906db6d
Do not allow notifications in private window.r=saschanaz

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing gv-junit failures in WebNotificationTest:
https://hg.mozilla.org/integration/autoland/rev/b93c29f308f934add5aea90aa94080e1c76036ee

Push with failures
Failure log

TEST-UNEXPECTED-FAIL | org.mozilla.geckoview.test.WebNotificationTest#onShowNotification | org.mozilla.geckoview.test.util.UiThreadUtils$TimeoutException: Timed out after 30000ms

Comment 5

[Harveer Singh]

Attachment: Bug 1843046: Ignored a android kt private notification test.r=#geckoview-reviewers

Depends on D184064

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/308fde20a1b1
Do not allow notifications in private window.r=saschanaz

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing geckoview-junit failures related to notifications:
https://hg.mozilla.org/integration/autoland/rev/ffeee9d4fb53c4a78cc804ac8282b86eee9e6c72

Push with failures
Failure log

TEST-UNEXPECTED-FAIL | org.mozilla.geckoview.test.WebNotificationTest#onShowNotification | org.mozilla.geckoview.test.util.UiThreadUtils$TimeoutException: Timed out after 30000ms
TEST-UNEXPECTED-FAIL | org.mozilla.geckoview.test.WebNotificationTest#clickPrivateNotificationParceled | org.mozilla.geckoview.test.util.UiThreadUtils$TimeoutException: Timed out after 30000ms

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5e8b64d6b91a
Do not allow notifications in private window.r=saschanaz
https://hg.mozilla.org/integration/autoland/rev/31e28d290422
Ignored a android kt private notification test.r=geckoview-reviewers,owlish

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for linting failure:
https://hg.mozilla.org/integration/autoland/rev/e9f4fc15eeeaa49d6f27e920e22a961b173dfa3b

Failure log

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Also still had a junit failure

TEST-UNEXPECTED-FAIL | org.mozilla.geckoview.test.WebNotificationTest#onShowNotification | org.mozilla.geckoview.test.util.UiThreadUtils$TimeoutException: Timed out after 30000ms

Comment 11

[Harveer Singh]

seems like the failing test is an intermittent wich is tracked here? https://bugzilla.mozilla.org/show_bug.cgi?id=1766739

Comment 12

[Harveer Singh]

oh I see that the failure reason is different than the one shown in the intermittent. I will investigate this.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ffeb6d319aa9
Do not allow notifications in private window.r=saschanaz
https://hg.mozilla.org/integration/autoland/rev/5038cbc4c1b3
Ignored a android kt private notification test.r=geckoview-reviewers,owlish

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ffeb6d319aa9
https://hg.mozilla.org/mozilla-central/rev/5038cbc4c1b3

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta and ESR115 approval.

Comment 16

[Harveer Singh]

Comment on attachment 9344756 [details]
Bug 1843046: Do not allow notifications in private window.r=#dom-storage-reviewers

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Currently, notifications are stored as a raw data on disk even for private browsing mode which is against firefox's security and privacy promise so we are disabling notifications in private browsing mode entirely such that we could get more time to properly implement private notifications.
• User impact if declined: Firefox would continue to store notifications in raw format on user machines in private session.
• Fix Landed on Version: 117+
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Code changes are not too complicated to apply and changes are only contained within notifications area only.

Beta/Release Uplift Approval Request

• User impact if declined: Currently, notifications are stored as a raw data on disk even for private browsing mode which is against firefox's security and privacy promise so we are disabling notifications in private browsing mode entirely such that we could get more time to properly implement private notifications.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: 1. Load a website which would generate notifications.

2. Allow permissions to get notifications (permission dialog wouldn't be generated in private session).
3. notifications are not delivered in private browsing session while they continue to deliver in non-private browsing session.

• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Code changes are not too complicated to apply and changes are only contained within notifications area only.
• String changes made/needed:
• Is Android affected?: Unknown

Comment 17

[Harveer Singh]

Comment on attachment 9348190 [details]
Bug 1843046: Ignored a android kt private notification test.r=#geckoview-reviewers

Beta/Release Uplift Approval Request

• User impact if declined:
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):
• String changes made/needed:
• Is Android affected?: Yes

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9344756 [details]
Bug 1843046: Do not allow notifications in private window.r=#dom-storage-reviewers

Approved for 117.0b9 and 115.2esr.

Comment 19

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/80796db900e6
https://hg.mozilla.org/releases/mozilla-beta/rev/bf609d109343

Comment 20

[Bogdan Maris, Desktop Test Engineering]

Do you have an example of a website with a notification on which I can test that this is fixed? Or is the one I used bellow good enough?

I tried a few push notification sample websites like https://cleverpush.com/en/test-notifications/ or https://pushalert.co/demo but using an old Nightly build before the fix (2023-07-12) no notification is shown in Private Window. Same with Firefox 117.0b9 which has the fix.

I also ran into this demo website https://www.bennish.net/web-notifications.html where I saw the following:

• If I open the demo in a private window in the old Nightly build and click on Authorize and then Show, I will get a notification. I will also have data in about:cache?storage=disk from the website.

The output of the console from the demo website:
Permission to display: granted
Notification #1 queued for display
Notification #1 showed

• If I open the demo in a private window in Firefox 117.0b9 build and click on Authorize and then Show, I will NOT get the notification. I will have NO data in about:cache?storage=disk from the website.

The output of the console from the demo website:
Permission to display: denied
Notification #1 queued for display
Notification #1 errored

Comment 21

[Harveer Singh]

Yes, https://www.bennish.net/web-notifications.html is the correct one to use for testing.

https://cleverpush.com/en/test-notifications/ website explicitly disables notifications in private session.

Comment 22

[Bogdan Maris, Desktop Test Engineering]

(In reply to Harveer Singh from comment #21)

Yes, https://www.bennish.net/web-notifications.html is the correct one to use for testing.

https://cleverpush.com/en/test-notifications/ website explicitly disables notifications in private session.

Thanks, I verified the behavior described in comment 20 using Latest Nightly 118.0a1 and Firefox 117.0b9 across platforms (Windows 10, macOS 13 and Ubuntu 22.04) on bennish.net website as a demo page, that the notification is disabled in private browsing and no data is stored on disk.

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/27e84a0d49de
https://hg.mozilla.org/releases/mozilla-esr115/rev/2d8400b399ed

Comment 24

[Bogdan Maris, Desktop Test Engineering]

Also verified as fixed using Firefox 115 esr across platforms (Windows 10, macOS 13 and Ubuntu 22.04).

Comment 25

[June Wilde (she/her) [:jewilde]]

Attachment: advisory.txt