406680 - non-chrome popups can still escape the dimensions of the content area and do weird things (e.g. make the browser transparent)

Status: RESOLVED FIXED

(Core :: XUL, defect, P3)

Description

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

[separating from bug 378532]
1) Load http://ctho.ath.cx/tmp/crash.xul
2) Type this in the URL bar (don't press enter)
javascript:for (var i=0; i<100000; i++) ; 5;
3) Press enter, and click the button before the page is replaced with the return value from setTimeout (most likely "2").

I couldn't reproduce this in Windows (though I was accessing the Windows box through (reasonably fast) VNC so I may not have gotten the events through quickly enough) but can reproduce it pretty easily on Linux.

If that's not clear enough, these may help:
http://ctho.ath.cx/tmp/ff2.avi - exploiting latest-1.8
http://ctho.ath.cx/tmp/ff3.avi - exploiting latest-trunk

Comment 1

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Forgot to security-flag the bug...sorry.  Jesse, thanks for fixing.  cc'ing people from the original bug.

Comment 2

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

FYI, the results I got:
A) sometimes, I get a popup that exceeds the size of the content area
B) sometimes, parts of the browser become invisble

Comment 3

[Neil Deakin]

3) Press enter, and click the button before the page is replaced with the
return value from setTimeout (most likely "2").

What setTimeout are you referring to?

Also, I can't get the videos to work.

Comment 4

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

(In reply to comment #3)
> 3) Press enter, and click the button before the page is replaced with the
> return value from setTimeout (most likely "2").
> What setTimeout are you referring to?

Sorry, I used to have a setTimeout() instead of the for loop.  Do it before the page is replaced with the return value from the "5;".

> Also, I can't get the videos to work.

http://www.xvid.org/Downloads.15.0.html (Divx or other MPEG4 codecs might handle them).

Comment 5

[Neil Deakin]

I can reproduce the invisible browser situation. Hard to tell exactly what's going on, but the global stylesheet isn't being included in the testcase, which causes the popup to be transparent. DOM inspector shows the background of the popup as 'transparent'. A popup in a content window should never be transparent though.

Maybe the other Neil has some insight here.

 

Comment 6

[[e-mail]]

(In reply to comment #5)
>A popup in a content window should never be transparent though.
We shouldn't even be calling the SetWindowTranslucency API for content popups.

Comment 7

[Damon Sicore (:damons)]

+'ing with P3.

Comment 8

[Neil Deakin]

It's possible that the transparency issue is the same as bug 322074.

Comment 9

[Daniel Veditz [:dveditz]]

qawanted: did bug 322074 actually fix this?

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Is this still an issue now that remote XUL is prevented?

Comment 11

[Andrew McCreight [:mccr8]]

Is remote XUL disabled in b2g18?  Hopefully.