233377 - input and img onmouseover allows javascript popups when popup blocker is active

Status: RESOLVED DUPLICATE of bug 197919

(SeaMonkey :: General, defect)

Description

[Philip Nilsson]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6) Gecko/20040113

The popup blocking in Mozilla(my version) and Mozilla Firebird(0.7 AFAIK), and
possibly others, is flawed. It allows a malicious HTML markupper to easily pop
up popups on the affected clients.

The problem lies in the onmouseover handling of the img, input and possibly
other elements. Or possibly in some other thing deeper in Mozilla.

Just see the HTML testcase look for yourselves.

Reproducible: Always
Steps to Reproduce:
1. Go to affected site
2. Possibly hover over affected elements
3. ???
4. Profit

Actual Results:  
Goatse, tubgirl, penisbird, lemonpary, unnamed picture(pillowfight?), and one
more all over the screen, reminded me of the good old days of using Internet
Explorer.

Luckily I'm quite immune to these pictures, the pain series are a little worse.

Expected Results:  
Blocked the popups.

HTML testcase coming...

Comment 1

[Philip Nilsson]

Attachment: html exploit testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

danm fixed this a few days ago.  Now we only allow a window.open() from inside
the following events:  "change click dblclick error reset submit"

This can be controlled via the "dom.popup_allowed_events" preference (that above
string is the default value).

*** This bug has been marked as a duplicate of 197919 ***