Closed Bug 411073 Opened 14 years ago Closed 14 years ago
File upload input focus stealing: if click event is canceled on label with tabindex, focus is set on file text entry field
2.82 KB, text/html
169.33 KB, application/java-archive
169.46 KB, application/java-archive
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:188.8.131.52) Gecko/20071127 Firefox/184.108.40.206 Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:220.127.116.11) Gecko/20071127 Firefox/18.104.22.168 If a label element associated with a file input element has a "tabindex" attribute, click events can be canceled and focus is set on the file text entry field. Once the focus is set on the file element, any entered keystrokes can be selectively captured and potentially used to upload arbitrary files from the user. Reproducible: Always Tested with user agents: - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:22.214.171.124) Gecko/20071127 Firefox/126.96.36.199 - Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:188.8.131.52) Gecko/20071127 Firefox/184.108.40.206 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:220.127.116.11) Gecko/20071127 Firefox/18.104.22.168 - Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:22.214.171.124pre) Gecko/20080106 BonEcho/126.96.36.199pre - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:188.8.131.52pre) Gecko/20080106 BonEcho/184.108.40.206pre
Assignee: nobody → dveditz
Product: Firefox → Core
QA Contact: firefox → toolkit
Status: UNCONFIRMED → NEW
Ever confirmed: true
Assignee: dveditz → Olli.Pettay
Attachment #295718 - Attachment mime type: application/zip → application/java-archive
The fix in bug 413135 makes this attack ineffective on branch; trunk not affected.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Version: unspecified → 1.8 Branch
Updated the example attack to use the disabled property to selectively cancel keystrokes. This bypasses the fix for bug 413135 in attachment 298006 [details] [diff] [review].
Yes, this is not fixed in branch. I ran all three demos test cases in Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:220.127.116.11) Gecko/2008012822 Firefox/18.104.22.168 and was able to reproduce the bug without difficulty.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
My bad. The test cause is counterintuitive. Olli and I just conferred and this is fixed. Re-resolving and verifying.
Status: REOPENED → RESOLVED
Closed: 14 years ago → 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.