1971924 - A large number of popups can be opened with a single user interaction

Status: RESOLVED DUPLICATE of bug 1973577

(Firefox for iOS :: General, defect)

Description

[Daniel Veditz [:dveditz]]

Attachment: click button to open multi-tab DOS

There doesn't seem to be a limit to the number of popups that can be opened with a single click. Inspired by the testcase in bug 1927905, this one spawns the specified number of tabs with a single click. The second testcase in bug 1927905 tried to open 500000 (even though the button says 5000). I don't think it managed to open that many, but it was hundreds at least. There should be only one popup opened for one "user activation" (e.g. clicking the button) and the others should be caught by the popup blocker.

This testcase doesn't do much with the extra windows, but if each of them was trying to chew up maximum CPU it wouldn't take many to make the browser unusable. And when there are hundreds of tabs open it's nearly impossible to close them all manually. the "Close all tabs" button can work, but then you would also be closing any other tabs you happened to be working in which would make people very unhappy.

Comment 1

[mreagan]

(In reply to Daniel Veditz [:dveditz] from comment #0)

Created attachment 9494511 [details]
click button to open multi-tab DOS

There doesn't seem to be a limit to the number of popups that can be opened with a single click. Inspired by the testcase in bug 1927905, this one spawns the specified number of tabs with a single click.

@dveditz I don't believe that WebKit offers any APIs which allow us to differentiate popups based on the user action. We get a webkit callback for creating the webview which is triggered by the window.open, but the related WKNavigationAction that is passed to us is not distinct to the user action. We get a new instance for each window.open call, and there's nothing that I can see so far that can be used to identify the "source click".

There is a property javaScriptCanOpenWindowsAutomatically on the web view configuration, this is what is configured by our "Block Pop-ups" setting. However this doesn't appear to have an effect for scripts like the one here, presumably since the user action triggered the JS.

I think the best thing we can probably do is throttle new popups based on the count and time limit.

I should add that at first glance this POC also appears to work on desktop (macOS), at least with the default settings that I'm using. I don't see Firefox for Mac preventing any of the window.open calls.

Comment 2

[Daniel Veditz [:dveditz]]

How do Safari and Chrome prevent this on iOS then?

The Firefox for Mac issue is because your popup blocker was turned off for the test site, probably. It works as expected for me on Mac.

Comment 4

[Daniel Veditz [:dveditz]]

The reporter of bug 1927905 refiled as this DOS bug. Easier to dupe to the later bug for bounty purposes.

Comment 5

[mreagan]

(In reply to Daniel Veditz [:dveditz] from comment #2)

How do Safari and Chrome prevent this on iOS then?

Safari may have access to SPI that we don't, as for Chrome I'm not certain what they're doing specifically. It could be leveraging the user gesture indicator though that isn't exposed directly in WebKit's APIs as far as I know. I tested the POC in Chrome iOS and they might simply be throttling the popups (after the 1st) based on how quickly they're opened. I could prod a little bit more to see if the timing changes the behavior. I would probably need to take a closer look at the Chromium source to determine what specific implementation they're using.

Comment 6

[mreagan]

Just an additional note: Brave appears to be susceptible to this problem also (it dutifully opens all tabs without any limit, AFAICS, even with Block Popups enabled).