1876851 - 1863831 working on latest 122 iOS Firefox Focus via Apple default apps like iOS Mail App

Status: RESOLVED DUPLICATE of bug 1863831

(Focus :: Security: iOS, defect)

Description

[James Lee]

We are able to reproduce it via Apple default apps like iOS Mail App.

1. Open https://pwning.click/googleloc.php and immediately leave the browser

2, Open Gmail and type in an Email Title: The first ever YouTube video

3. "Text to display": https://www.youtube.com/watch?v=jNQXAC9IVRw

4. "Link to: Web address": firefox-focus://open-url?url=javascript:document.write(document.domain)

5. Send this to your iOS Apple Mail App sync'd email account address

Comment 1

[James Lee]

Of course, the link could be any legitimate link instead like https://google.com, https://apple.com etc.

Comment 3

[lmarceau]

The following steps are also another way to reproduce this issue (using Safari and provided links instead of Gmail) as seen in 1863831

Steps to reproduce

1. Navigate to https://pwning.click/googleloc.php
2. Leave Focus application (by moving it to background)
3. Open Safari
4. Navigate to https://pwning.click/focuslink.php in Safari
5. Click on the link "Open with Firefox Focus"

Actual behavior

Focus is opened and JavaScript is running

Expected behavior

Focus is opened and JavaScript should not be running

Comment 4

[Daniel Veditz [:dveditz]]

This says it's a variant of bug 1863831, but tested in v122 while that bug appears to have been fixed in v123 (I think? checking on that). Is this perhaps exactly the same and is now fixed?

Comment 5

[James Lee]

bug 1863831 was fixed on v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

But I confirmed bug 1863831 and bug 1880745 were properly fixed on v123 for some reason.

Comment 6

[James Lee]

Please confirm this report worked up to Focus v122.1 like we can check from this demo video link https://pwning.click/RPReplay_Final1708482262.mp4 despite the fix for v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Comment 7

[James Lee]

Sorry for the needinfo here, I just want to make sure that we confirm the above comment.

(In reply to James Lee from comment #6)

Please confirm this report worked up to Focus v122.1 like we can check from this demo video link https://pwning.click/RPReplay_Final1708482262.mp4 despite the fix for v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Comment 8

[James Lee]

(In reply to James Lee from comment #7)

Sorry for the needinfo here, I just want to make sure that we confirm the above comment.

(In reply to James Lee from comment #6)

Please confirm this report worked up to Focus v122.1 like we can check from this demo video link https://pwning.click/RPReplay_Final1708482262.mp4 despite the fix for v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Ah, I'll cancel needinfo since I should've added them on bug 1880745

Comment 9

[James Lee]

Ah my bad, #c7 is correct; this is another one that was also fixed on v123 for some reason.

Sorry for the needinfo here, I just want to make sure that we confirm the above comment.

(In reply to James Lee from comment #6)

Please confirm this report worked up to Focus v122.1 like we can check from this demo video link https://pwning.click/RPReplay_Final1708482262.mp4 despite the fix for v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Comment 10

[lmarceau]

Hello, I tested in v123 and indeed it seems like this issue was fixed (we load a search with the "javascript" rather than running the javascript itself). Let me know if you think otherwise. Thank you!

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Should this be marked as a duplicate, and/or fixed?

Comment 12

[Andrew McCreight [:mccr8]]

I don't know.

Comment 13

[mreagan]

Per above comments it appears this was fixed in v123; it seems like we can safely close this, however if anyone has concerns that there are still remaining issues here please let me know. I'm not entirely sure why it wasn't closed earlier, it looks like it may be that it was resolved as a side-effect of a separate set of changes in Focus.

Comment 14

[mreagan]

Note: Bugzilla does not allow me to set the Fix field to the applicable version (it only appears to provide the 3 most recent versions as options). @dveditz Is there any way to properly set that field in the ticket at this point?

Comment 15

[Daniel Veditz [:dveditz]]

(In reply to mreagan from comment #14)

Note: Bugzilla does not allow me to set the Fix field to the applicable version [...] @dveditz Is there any way to properly set that field in the ticket at this point?

Not really, short of asking admins to force it in there. But since there's no separate fix responsible for this it seems to be a dupe after all