1959115 - DLP agent does not scan text pasted into Chatbot shortcut text field

Status: RESOLVED FIXED

(Firefox :: Data Loss Prevention, defect)

Description

[Bianca Hidecuti, Desktop Test Engineering [:bhidecuti]]

Attachment: video showing the issue

Found in

• 138.0b4

Affected versions

• 139.0a1
• 138.0b4

Tested platforms

• Affected platforms: Windows 10/11
• Unaffected platforms: Ubuntu, macOS

Preconditions

• Download the DLP test assets from https://drive.google.com/file/d/1yjqVRuxdKV3WnO7D2wzMgDXBuYBxUgVw/view
• Create a distribution folder inside the Firefox folder and paste the policies-1.json to it and then rename it to policies.json
• DLP Agent is running: .\content_analysis_sdk_agent.exe --user --toblock=.*\d{3}-?\d{2}-?\d{4}.* --towarn=.*warn.* --delays=10
• Have a chatbot provider selected in the sidebar (e.g. ChatGPT)

Steps to reproduce

1. Navigate to any webpage (e.g. wikipedia.org) and select some text to trigger the chatbot shortcut
2. Hover over the chatbot shortcut and paste any random text inside the text field in the chatbot shortcut menu
3. Observe the behavior

Expected result

• The text should be scanned by the DLP agent

Actual result

• The text is not scanned by the DLP agent and is pasted directly into the field

Regression range

• Not a regression (also reproducing with Firefox 133.0a1)

Additional notes

• Attached a screen recording
• If pressing the "Enter" key after pasting the text, the text is sent to the chatbot in the sidebar. This may allow users to bypass the DLP agent

Comment 1

[Greg Stoll :gstoll]

Attachment: Bug 1959115 - monitor pastes into GenAI custom prompt for Content Analysis r=#dlp-reviewers!,#firefox-ai-ml-reviewers!

We handle this similarly to pasting into a prompt() dialog, so I
refactored that logic into a new ContentAnalysisUtils and call it from
both places.

Also drive-by cleanup of BUG_COMPONENT for a few Content Analysis
moz.build's

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8517aa5a4d0d
monitor pastes into GenAI custom prompt for Content Analysis r=dlp-reviewers,firefox-ai-ml-reviewers,handyman,Mardak

Comment 3

[Cristian Tuns]

Backed out for causing bc failures in /browser_clipboard_paste_prompt_content_analysis.js

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | toolkit/components/contentanalysis/tests/browser/browser_clipboard_paste_prompt_content_analysis.js | Correct number of calls to getURIForBrowsingContext() - Got +0, expected 1

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f0e332d48c05
monitor pastes into GenAI custom prompt for Content Analysis r=dlp-reviewers,firefox-ai-ml-reviewers,handyman,Mardak

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f0e332d48c05

Comment 6

[Bianca Hidecuti, Desktop Test Engineering [:bhidecuti]]

Attachment: shortcut.mp4

Verified this using Firefox Nightly 139.0a1 (2025-04-13), on Windows 11 and the text pasted into Chatbot shortcut text field is now scanned by the DLP agent.
However, I've noticed two behaviors during verification:

1. While the scan is in progress, it's still possible to enter text into the Chatbot shortcut text field
2. After interacting with the DLP dialogs, the Chatbot shortcut menu disappears, resulting in being unable to verify the output in the text field (attached a video as well)

@greg, could you please let us know if we should file separate issues for the above behaviors? Thank you in advance!

Comment 7

[Greg Stoll :gstoll]

Yeah, if you could file separate issues for these that would be great. Thanks!

Comment 8

[Bianca Hidecuti, Desktop Test Engineering [:bhidecuti]]

Logged bug 1960571 and bug 1960576, for the behaviors mentioned in Comment 6.
Based on Comment 6, I am marking this verified as fixed.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:gstoll, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval. Also, don't forget to request an uplift for the patches in the regression caused by this fix.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox138 to wontfix.

For more information, please visit BugBot documentation.