1887805 - Clickjacking to allow permission using datepicker and pointerlock

Status: RESOLVED FIXED

(Toolkit :: PopupNotifications and Notification Bars, defect)

Description

[Hafiizh]

Attachment: bandicam 2024-03-26 09-28-58-568.mp4

when activating pointerlock the cursor by default is in the middle of the screen and visible but using datepicker the pointer is visible and can interact so this can cause clickjacking

steps to reproduce:

1. open vidk.html
   2 click on "Choose Date" button
2. do many Click on "next month" button

Operating System : Windows 10
Firefox version : Firefox Nightly version 126.0a1 (2024-03-25) (64-bit)

Comment 1

[Hafiizh]

Attachment: vidk.html

Comment 2

[:Gijs (he/him)]

Paul, can you take a look?

Comment 3

[Emma Zühlcke [:emz]]

Harshit, can I forward this one to you?

Comment 4

[Harshit Sohaney [:hsohaney]]

This looks reproducible on mac, but it's a bit buggy (it doesn't actually click allow on my machine). I will try it on a windows vm and confirm. Happy to take this!

Comment 5

[Emma Zühlcke [:emz]]

The fact that it doesn't accept the click for up to 2 seconds is intended behavior and means the clickjacking protection is working. See https://searchfox.org/mozilla-central/rev/7bbc54b70e348a11f9cd12071ada2cb47c8a14e3/toolkit/modules/PopupNotifications.sys.mjs#1345-1346,1349,1351 for the code doing that.
What's unexpected / unwanted is the fact that when interacting with the date picker the cursor jumps to the allow button and it immediately accepts the prompt.
Clicks not going through for a bit after the prompt shows would be an acceptable solution. I'm curious why the code we added for pointerlock doesn't get triggered here.

Comment 6

[Hafiizh]

Hello any updates?

Comment 7

[Edgar Chen [:edgar]]

After bug 1743329, pointer lock is not allowed when xul popup is opened, so I think it also fixes this.

Comment 8

[Emma Zühlcke [:emz]]

It would be worth checking whether this still works now that Bug 1743329 has been fixed.

Comment 9

[Harshit Sohaney [:hsohaney]]

I tried reproducing on my vm, but could not reproduce anymore. Reporter, could you validate if this is still reproducible?

Comment 10

[Hafiizh]

I can still reproduce it on Firefox version 127.0 (64-bit) but on Firefox developer edition version 128.0b3 (64-bit) I can't reproduce it. Is it fixed in version 128?

Comment 11

[Hafiizh]

Attachment: firefox127_0.mp4

firefox 127.0

Comment 12

[Hafiizh]

Attachment: firefox128_0b3(64-bit).mp4

firefox 128.0b3 (64-bit) developer edition

Comment 13

[Hafiizh]

in version >=128 when the choose date button is selected the pointerlock is not active (exit pointer lock) but in version 127 the pointerlock is still active

Comment 14

[Emma Zühlcke [:emz]]

As per comment 8 Bug 1743329 most likely fixed this. That patch targets 128 (and later). Thanks for confirming!

Comment 15

[Frederik Braun [:freddy]]

Thanks for reporting this to us. Looks like someone else was faster here.

Comment 16

[Hafiizh]

Hello Have i get cve for this vulnerabilty?

Comment 17

[Simon Friedberger [:simonf]]

No because this was part of another, previously reported bug.