1987929 - PointerEvent.persistentDeviceId maybe leaks pen inputs with RFP

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Pier Angelo Vendrame]

According to the code, persistentDeviceId will be 1 for mouse events, 0 otherwise.
I wonder if this could leak pen events, for example. However, I won't access to my drawing table for a while to check if it's actually the case.
FWIW, other methods have a check on ShouldResistFingerprinting first.

Comment 1

[Pier Angelo Vendrame]

Notice that if pointerType isn't spoofed, this is just equivalency.
So, if the idea is that we don't want to spoof the type, this can be closed.

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1968400

:smaug, since you are the author of the regressor, bug 1968400, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 9/8)]

Currently, it returns only 0 or 1. We haven't implemented it under widget/ to make web apps possible to distinguish physical pens.

Comment 4

[Pier Angelo Vendrame]

I've managed to have this tested.
Under RFP, we report both the actual pointer type and persistentDeviceId consistently.
However, everything about pens (angles, pressure, etc...) is spoofed.
So, I think it'd make sense to disguise pens as mouse on desktop.
I would say it'd make sense to disguise both pens and mice as touch on Android, but this would be detectable, as touch will also trigger touchstart, touchend and touchmove events, whereas mice currently don't do it (I tested MDN's example with a bluetooth mouse on my phone).
I didn't think of testing that example also on desktop, maybe I'll be able to do it later.

Comment 5

[Pier Angelo Vendrame]

Attachment: Bug 1987929 - Hide pen input in RFP on desktop. r?masayuki

The pen features (pressure, angles, etc...) are already spoofed.
However, we still tell that the input comes from a pen.
At this point, we can pretend it came from a mouse.

Comment 6

[Manuel Bucher [:manuel]]

Landing for pierov.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/35055c39b060
https://hg.mozilla.org/integration/autoland/rev/13cff59b5052
Hide pen input in RFP on desktop. r=masayuki,webidl,saschanaz

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/50c5bd85257c
https://hg.mozilla.org/integration/autoland/rev/57aa58816161
Revert (Bug 1987929, Bug 1991701) - for causing perma failures @test_pointer_event.html.

Comment 9

[agoloman]

Backed out for causing perma failures @test_pointer_event.html.

• Backout link
• Push with failures
• Failure Log

Comment 10

[Pier Angelo Vendrame]

Sent new revisions, but tjr is currently out, so I think this will have to wait a little bit.
FWIW, from the try build everything seems fine now to me: https://treeherder.mozilla.org/jobs?repo=try&revision=9d511d1287b9cfe5ae45252e425ecebdc7246ce2

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/996938e0bc68
https://hg.mozilla.org/integration/autoland/rev/df7f4e789687
Hide pen input in RFP on desktop. r=masayuki,webidl,saschanaz

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/df7f4e789687

Comment 13

[BugBot [:suhaib / :marco]]

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

Comment 14

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:pierov, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox145 to wontfix.

For more information, please visit BugBot documentation.