1846205 - (CVE-2023-5726) File picker should cause the browser window to lose focus on Mac

Status: VERIFIED FIXED

(Core :: Widget: Cocoa, defect, P3)

Description

[Edgar Chen [:edgar]]

+++ This bug was initially created as a follow-up of Bug #1821884 comment# 40 +++

It appear that opening a file picker doesn't cause the browser window to lose focus on Mac (web content doesn't receive the blur event), so the solution in bug 1821884 doesn't work on Mac. I tested Chrome and Safari on Mac, both of them move the focus out of browser window when the file picker is opened, we probably should do the same.

Comment 1

[Stephen A Pohl [:spohl]]

(In reply to Edgar Chen [:edgar] from comment #0)

+++ This bug was initially created as a follow-up of Bug #1821884 comment# 40 +++

It appear that opening a file picker doesn't cause the browser window to lose focus on Mac (web content doesn't receive the blur event), so the solution in bug 1821884 doesn't work on Mac. I tested Chrome and Safari on Mac, both of them move the focus out of browser window when the file picker is opened, we probably should do the same.

When opening the file picker, the window control buttons in the top left corner change as if the window was losing focus. Is it possible that the window loses focus correctly, but that web content doesn't receive the expected blur event?

Comment 2

[Edgar Chen [:edgar]]

Yes, it is possible that browser window doesn't receive the WindowDeactivated notification, so it doesn't update the focus state properly.

Comment 3

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/jobs?repo=try&revision=fca9e67bc2adf4def3e5c3b31ca6218d633109c3

Comment 4

[Edgar Chen [:edgar]]

Attachment: Bug 1846205 - Use key state change to send activate/deactivate event when a modal window is opened; r?mstange,#mac-reviewers

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a9c4719acd72
Use key state change to send activate/deactivate event when a modal window is opened; r=spohl,mac-reviewers

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a9c4719acd72

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:edgar, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox119 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Edgar Chen [:edgar]]

Comment on attachment 9348977 [details]
Bug 1846205 - Use key state change to send activate/deactivate event when a modal window is opened; r?mstange,#mac-reviewers

Beta/Release Uplift Approval Request

• User impact if declined: Fullscreen warning notification is overlapped by file picker, which could lead to address bar UI spoofing on macOS.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Same steps as https://bugzilla.mozilla.org/show_bug.cgi?id=1821884#c40
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This make the cocoa widget send activate/deactivate event properly when modal window is opened, should be safe.
• String changes made/needed: None
• Is Android affected?: No

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is not a sec-high/crit bug, but this patch make the solution of bug 1821884 working on macOS.
• User impact if declined: fullscreen warning notification is overlapped by file picker, which could lead to address bar UI spoofing.
• Fix Landed on Version: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This make the cocoa widget send activate/deactivate event properly when modal window is opened, should be safe.

Comment 9

[Dianna Smith [:diannaS]]

Comment on attachment 9348977 [details]
Bug 1846205 - Use key state change to send activate/deactivate event when a modal window is opened; r?mstange,#mac-reviewers

Approved for 119.0b4

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/1511935b5216

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9348977 [details]
Bug 1846205 - Use key state change to send activate/deactivate event when a modal window is opened; r?mstange,#mac-reviewers

Approved for 115.4esr

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/6961bd61cb51

Comment 13

[Anca Soncutean, Desktop QA]

Reproduced with Fx 117.0a1 (2023-07-31) on macOS 13.
Verified fixed with Fx 120.0a1 (2023-10-02), Fx 119.0b4 and Fx ESR 115.4 (treeherder build) on macOS 13.

Comment 14

[Tyson Smith [:tsmith]]

Attachment: advisory.txt

Comment 15

[Daniel Veditz [:dveditz]]

Bulk-unhiding security bugs fixed in Firefox 119-121 (Fall 2023). Use "moo-doctrine-subsidy" to filter