323256 - quick search doesn't hit form submission warning

Status: VERIFIED WONTFIX

(Firefox :: Search, defect)

Description

[el3000]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

Any quick search allows bypass of user prompt asking for permission to send information to the internet.

Reproducible: Always

Steps to Reproduce:
1. Log in from a new profile.
2. Perform a quick search.
3. No prompt to confirm that it is OK to send information to the internet.
4. Malicious user could exploit this.

Actual Results:  
No prompt asking user for permission to send information over internet.

Expected Results:  
Prompt should appear asking user permission to send information over internet, just as if operation was performed without quick search.

Comment 1

[Mike Connor [:mconnor]]

Not a security exploit, possibly privacy, but if you type data into the search box and hit enter, its pretty obvious you're sending information somewhere.  The form submit is not quite as obvious in many cases.

Beltzner, any thoughts here? (its too early/late, but I'm thinking WONTFIX)

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

This will be more clear when we get the grey background text in the search bar saying "search with google" or whatever. The "send information to the internet" is a warning to prevent people from inadvertantly sending information to cover malicious use. None of the quicksearches we include really fall into that category - if they did, that'd be a whole different class of bug.

Finally, doing this would make a pretty disastrous out of the box user experience. Download, try to search, get a "oh noes! you're sending information out on the internets!". Ick. :)

Comment 3

[Phil Ringnalda (:philor)]

*** Bug 238235 has been marked as a duplicate of this bug. ***

Comment 4

[Jackie Liu]

*** Bug 238235 has been marked as a duplicate of this bug. ***

Comment 5

[Ria Klaassen (not reading all bugmail)]

*** Bug 356276 has been marked as a duplicate of this bug. ***