2072088 - [css-random] Ensure random() values are the same across static cloned documents (print preview)

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, task)

Description

[Sajid Anwar [:sajidanwar]]

The random() function has a document-level identifier that influences every generated value; and additionally, any functions with an element-scoped key has an element-level identifier that influences those generated values. This is somewhat tricky with Gecko's static cloned documents (Bug 487667) which are used for print previews. Since the document and all elements within are cloned, a simple implementation that uses document/element pointer addresses in the random value generation will generate all new values in a print preview document.

Secondary concern is that since authors have full control of the cache key, they could generate an arbitrary number of hash(--foo + <document-pointer-address>) -> seed -> PRNG value values and possibly reverse engineer the document pointer address. (Maybe, not really any experience with security but this seems plausible and probably shouldn't be allowed.)

Comment 1

[Sajid Anwar [:sajidanwar]]

Attachment: CSS random() + Print Preview

Test case that generates random widths for bars, and then places tick marks at the computed widths. When the user enters print preview, the bars and tick marks should match. If the bars are different widths and don't match the tick marks, then it means that the random widths changed.

Chrome and Safari retain the random values in print preview. Firefox does not.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Well they retain the whole document, which has its own issues...

Comment 3

[Sajid Anwar [:sajidanwar]]

Attachment: CSS random() + Print Preview

Comment 4

[Sajid Anwar [:sajidanwar]]

Attachment: Bug 2072088 - Ensure random() values are the same across static cloned documents. r=#style

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ff745ebfb64c
https://hg.mozilla.org/integration/autoland/rev/31da9f95ccc0
Ensure random() values are the same across static cloned documents. r=firefox-style-system-reviewers,layout-reviewers,emilio

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/31da9f95ccc0