304124 - scripts can move content/UI offscreen

Status: RESOLVED WONTFIX

(Camino Graveyard :: General, defect)

Description

[Josh Aas]

playing it safe, marking this as a security bug

Enter the following into the Camino URL bar:

javascript: window.resizeTo(2000,2000)

Notice the height is constrained, but the width can actually become 2000,
putting the right side of the window off the screen. This can hide content and
our security UI.

Looks like we don't implement ConstrainPosition() in nsCocoaWindow.mm

Comment 1

[Simon Fraser [no longer active]]

Camino doesn't use nsCocoaWindow.mm; we need to do this in Camino code.

Comment 2

[Simon Fraser [no longer active]]

I don't think this is is quite so bad, since
1. we have a pref to not change the size/postion of windows (is this on by
   default?)
2. the user can always click the green to resize the window back so that it
   fits on screen.

Comment 3

[Jesse Ruderman]

> 2. the user can always click the green to resize the window back so that it
>   fits on screen.

The concern is that users won't notice that the "real" status bar is off of the
screen while the web page shows something that looks like a status bar.

Comment 4

[Josh Aas]

Can we drop security status on this bug?

Comment 5

[Mike Pinkerton (not reading bugmail)]

but the status bar is still visible, as is the yellow/non-yellow-ness of the url bar. i'm confused how they could hide the status bar.

Comment 6

[Daniel Veditz [:dveditz]]

CC'ing smorgan per request on #foxymonkies

Comment 7

[Stuart Morgan]

(In reply to comment #3)
> The concern is that users won't notice that the "real" status bar is off of the
> screen while the web page shows something that looks like a status bar.

How is this possible with a constrained height?  Without a demonstration/explanation of how there could be a spoof here, I'm not seeing how this is a security issue as opposed to a minor annoyance.

Comment 8

[Jesse Ruderman]

I misunderstood the bug when I added comment 3.  Making public.

Comment 9

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Setting this for 1.2, but if I've misunderstood the severity, please retarget.

Comment 10

[Josh Aas]

Over to smorgan, I'm not going to be able to look into this and fix it or make a decision about it any time soon.

Comment 11

[Gordon P. Hemsley [:GPHemsley]]

This bug has been buried in the graveyard and has not been updated in over 5 years. It is probably safe to assume that it will never be fixed, so resolving as WONTFIX.

[Mass-change filter: graveyard-wontfix-2014-09-24]