1880566 - websites can call moveTo as many times as they like, moving windows around randomly

Status: RESOLVED DUPLICATE of bug 502561

(Core :: DOM: Core & HTML, defect, P3)

Description

[andrew]

steps to reproduce

go to https://mehliug-git.github.io/cool-website/moveto.html

and then click the click me for start the test

then you will notice a message saying it's blocking pop us when in reatily out of full screen you can see the pop up from the website moving around the desktop making it a bit diffult to interact with your pc

Comment 1

[andrew]

if we see how the tor browser and the brave browser approach this for example brave allows this however sets a limit for how many times it can move around the desktop and eventually stops while chrome and firefox just keeps moving the hardcore approach of tor basically doesn't allow this

Comment 2

[andrew]

See also https://issues.chromium.org/issues/325321592

Comment 3

[Daniel Veditz [:dveditz]]

Firefox supports a pref that disallows this functionality entirely, and Tor is probably using that. I know I set that personally. Otherwise this is following the web spec though so it's hard to call a security vulnerability. We may or may not have an existing bug to change the default pref setting in which case this would be a duplicate, but otherwise this could be that bug.

The pref is dom.disable_window_move_resize

Comment 4

[Daniel Veditz [:dveditz]]

I should clarify that the pref I mention in comment 3 prevents using moveTo at all and is a blunt instrument. Allowing the feature but limiting its use to a response to user activation would be a better approach.