Closed Bug 408164 Opened 17 years ago Closed 17 years ago

Web forgery warning not shown until tab switch

Categories

(Toolkit :: Safe Browsing, defect)

Product:
Toolkit
Component:
Safe Browsing
Version:
2.0 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: emil, Assigned: tony)

References

(
URL
)

Details

(Keywords: verified1.8.1.12, Whiteboard: [sg:low spoof] found in the wild)

Attachments

(1 file)

remove height check code
3.68 KB, patch
dcamp
: review+
dveditz
: approval1.8.1.12+
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.11) Gecko/20071205 Firefox/2.0.0.11 Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.11) Gecko/20071205 Firefox/2.0.0.11 On URL provided the web forgery warning dialog doesn't show up unless I switch tab, and then switch back. Reproducible: Always Steps to Reproduce: 1. Open URL http://business-internet-banking.hsbc.com.hfye223.ph/bibauth/formStart/ 2. Open new tab / switch tab 3. Switch back to first tab Actual Results: Web forgery warning appears after step 3. Expected Results: Web forgery warning should appear after step 1. Tested on Firefox 2.0.0.11 in Gentoo amd64 Ubuntu 7.10 amd64 Windows XP SP2 Mac OS X Leopard (10.5.1)
Seems that the CSS is causing the bug. When I block the referenced stylesheet (http://business-internet-banking.hsbc.com.hfye223.ph/bibauth/formStart/0.css) I recieved the warning right away.
Found minimal proof of concept HTML+CSS-code, but don't know how to hide bug. Please mail me!
Confirmed on Mac OS X Leopard (10.5.1) with Firefox 2.0.0.11 and Ubuntu 7.10 amd64 with Firefox 2.0.0.11.
Group: security
Component: Security → Phishing Protection
QA Contact: firefox → phishing.protection
The bug is now hidden, but the site in question seems to be gone :-( Without the site actually there I get the forgery warning right away. The bug is now hidden so I'm posting your mail to security@mozilla.org that contains additional details: However, after some research we found out that the bug appears as soon as all content in the body of a page is contained in a div with absolute position. Example follows: <html><head><title>Test</title> <style> #idTag { position: absolute; top: 40; border: 1px solid red; } #idTag2 { position: absolute; top: 90; border: 1px solid blue; } </style> </head><body> <div id="idTag">Jajaja</div> <div id="idTag2">&nbsp;</div> </body></html> Regards Emil Ljungdahl Lars-Olof Moilanen
The easiest way to reproduce is maybe these steps: 1. Install local webserver 2. Put the HTML file below in $WEBROOT/firefox/its-a-trap.html 3. Add 127.0.0.1 www.mozilla.com to /etc/hosts 4. Browse to http://www.mozilla.com/firefox/its-a-trap.html <html><head><title>Test</title> <style> #idTag { position: absolute; top: 40; border: 1px solid red; } #idTag2 { position: absolute; top: 90; border: 1px solid blue; } </style> </head><body> <div id="idTag">Jajaja</div> <div id="idTag2">&nbsp;</div> </body></html>
even easier, perhaps, would be to hand-edit the array of test urls in components/nsSafebrowsingApplication.js (even in release versions) to contain whatever you need. I can confirm this bug with that testcase on a local server. Losing focus to another window doesn't do it, but switching back from another tab (which can pre-exist) does. note: once you've dismissed the webforgery warning you must reload the page to reset the testcase.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Whiteboard: [sg:low spoof]
This doesn't currently apply to Firefox 3 where the current implementation is a complete block (shared with malware blocking). Is that intended to be the final implementation, or an interim step before going back to the FF2-style overlay? Whether this blocks FF3 or not would hinge on that question.
Flags: blocking1.8.1.12?
Flags: blocking-firefox3?
The FF3 implementation is final, so it sounds like this only applies to FF2.
not planning on changing it, so not an fx3 blocker
Flags: blocking-firefox3?
Since this trick was originally found in the wild we probably need to fix this for Firefox 2, the bad guys are known to share their tricks.
Assignee: nobody → tony
Flags: wanted1.8.1.x+
Flags: blocking1.8.1.12?
Flags: blocking1.8.1.12+
Whiteboard: [sg:low spoof] → [sg:low spoof] found in the wild
Version: unspecified → 2.0 Branch
Ok, I'll try to look at this over the weekend. Things might be a bit slow because of the holiday.
Status: NEW → ASSIGNED
When a page is loading, there is a check to see if content exists before we draw the warning bubble. The content check only looks to see if the height of the body is > 0. In the example cases, body has a height of 0 so we never draw the warning bubble during page load. This check was originally added because it took a snapshot of the page before drawing the gray over it. This would result it a grey page with no content if content wasn't loaded. This check isn't needed anymore because we re-snapshot the page periodically. So the fix is to just removed this check completely. If a page is loading, we may get the grey over a blank page, but as the page continues loading, the grey overlay will get updated to have the page content. It may look a bit funny if the page never loads (e.g. a hanging GET), but that doesn't seem to be a real problem.
Attachment #294458 - Flags: review?(dcamp)
Thanks Tony! no need to kill your holidays on this, we've got a lot of fixes yet to land and code-freeze for Firefox 2.0.0.12 won't be until mid-January.
Attachment #294458 - Flags: review?(dcamp) → review+
Attachment #294458 - Flags: approval1.8.1.12?
Comment on attachment 294458 [details] [diff] [review] remove height check code approved for 1.8.1.12, a=dveditz for release-drivers
Attachment #294458 - Flags: approval1.8.1.12? → approval1.8.1.12+
Checking in browser-view.js; /cvsroot/mozilla/browser/components/safebrowsing/content/browser-view.js,v <-- browser-view.js new revision: 1.1.2.3; previous revision: 1.1.2.2 done
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Keywords: fixed1.8.1.12
Resolution: --- → FIXED
Verified for 1.8 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.12) Gecko/2008012822 Firefox/2.0.0.12 and my friendly local webserver.
Keywords: fixed1.8.1.12 → verified1.8.1.12
Group: security
Flags: in-testsuite?
Product: Firefox → Toolkit
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: