248920 - Cursor movement on Web Page starts Email Client

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[kelso]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040614 Firefox/0.9
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040614 Firefox/0.9

With Javascript enabled, passing cursor over line containing "Completely Safe
Link - Trust Me" will start email client - Eudora 4.3. Disabling Javascript
prevents program from starting.

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.digicrime.com/noprivacy.html using Firefox/0.9 with
Javascript enabled.
2. Pass cursor over line (no necessarily the words) containing "Completely Safe
Link - Trust Me"


Actual Results:  
1) Message box came up stating "You probably just sent mail ..."
2) Email client started - Eudora 4.3 started with new mail addressed to
"[e-mail]" 

Expected Results:  
Nothing.

I do not believe the mail was accually sent but that may have been due to my
settings within Eudora.

Comment 1

[Jesse Ruderman]

Modern mail clients don't send mail immediately in response to mailto forms. 
They usually bring up a mail composition window, letting you inspect or modify
the message before sending it.

Comment 2

[Daniel Wang]

-> invalid
The page intends to demonstrate an old security flaw in Netscape, which doesn't
apply to us.

Comment 3

[Phil Ringnalda (:philor)]

*** Bug 294453 has been marked as a duplicate of this bug. ***

Comment 4

[Frank]

(In reply to comments #1 and #2)

>Modern mail clients don't send mail immediately in response to mailto forms. 
>They usually bring up a mail composition window, letting you inspect or modify
>the message before sending it.

Yes thats how they're supposed to work, it should just display a blank message
and not send anything. When I tested it, Thunderbird opened up a blank
composition window but didnt send anything, so just to make sure, I switched the
default to Outlook Express and it did manage to somehow send a blank message to
the mailto link in the script. It may be because of my settings in Thunderbird
that it didnt send the message but I can't be too sure. 

> -> invalid
> The page intends to demonstrate an old security flaw in Netscape, which
>doesn't apply to us.

I partially disagree. Yes, it was originally a flaw in Netscape and that is
exactly what that page was meant to demonstrate, im not arguing that at all.
But, and correct me if I am wrong, I was/am under the assertion that any
vulnerability most certainly applies to us if it can be exploited on a
non-netscape Mozilla build, which is firefox in this case.