393900 - showModalDialog doesn't show a location bar, making spoofing trivial

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase

If you click the "open a modal dialog" button in the testcase, you'll see that it opens a sheet with the same size as the browser window, perfectly covering all the toolbars.  This would make it trivial for a malicious site to put up a fake address bar making it look like you're on a different site.  The only hints are the lack of a resizing grippy (lower right of the window) and the "sheet coming down" animation.

showModalDialog() sheets probably need the same treatment that window.open() got in bug 337344 to always show some kind of location bar.

Comment 1

[Alex Vincent [:WeirdAl]]

Jesse:  Firefox 2 on Windows doesn't even open a modal dialog, saying showModalDialog doesn't exist.  Regression of some kind?

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/2007072518 Firefox/2.0.0.6

Comment 2

[Jesse Ruderman]

showModalDialog was added after Firefox 2 (in bug 194404).

Comment 3

[Johnny Stenback (:jst)]

Attachment: Make modal dialogs obey window feature prefs.

This fixes the problem with modal dialogs not obeying the prefs that control what window features are forced on windows created by scripts, and this makes us match IE closer too. The problem was that due to the code path we end up going through when opening up a modal dialog we end up pushing null on the context stack before entering the window watcher, which makes it think chrome is doing the opening and ignores the prefs in question. That's obviously bad. And in addition to that, I had to tweak a macro that also made us ignore the prefs for dialogs, and modal content dialogs are treated as dialogs (aDialog is true) in the window watcher code.

Comment 4

[Johnny Stenback (:jst)]

Fix checked in.

Comment 5

[Justin Dolske [:Dolske]]

I viewed the testcase, and then used the History menu to get back to the bug. Now I'm in a window with no toolbars or location bar. Doh.

Seems like history shouldn't apply to dialogs; is this made moot by this patch, or is there another bug here?

Comment 6

[Johnny Stenback (:jst)]

Um, I have no idea what went wrong there. Doesn't sound related to what went in to fix this in any case. If I go to the testcase, open a modal dialog, there's no history there (as nothing else has loaded in that window yet), and if I close the dialog and go back to the bug in the original window things work as expected here. Can you reliably reproduce what you're seeing?

Comment 7

[Justin Dolske [:Dolske]]

I filed bug 395465 for the issue I'm seeing on OS X.

Comment 8

[Boris Zbarsky [:bzbarsky]]

So...  this regressed bug 294440.  That macro wasn't checking the chrome thing for a reason.