413759 - Dragging bookmark to text field reveals bookmark content rather than navigating to bookmark

Status: RESOLVED INACTIVE

(Firefox :: Bookmarks & History, defect)

Description

[Ben Adida]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

A bookmark may contain personal information. In IE7, dragging the bookmark to the page navigates the page as if the bookmark had been clicked. In Safari, dragging the bookmark of the bookmarks bar deletes the bookmark. In Firefox, the behavior is the same as IE *EXCEPT* when dragging the bookmark to a text field input. In that case, the URI of the bookmark is inserted in the text field.

When the bookmark is used for secret information, e.g. BeamAuth <http://ben.adida.net/projects/beamauth>, this can result in a social engineering attack. Because users are already accustomed to adding the bookmark by dragging it to their bookmarks bar, they may be tricked into dragging it back to a phishing page.

Reproducible: Always

Steps to Reproduce:
1. Drag link to bookmarks bar
2. Drag bookmark back to text field
Actual Results:  
The URI of the bookmark is inserted into the text field.

Expected Results:  
Same as if the bookmark were clicked.

Comment 1

[Ben Adida]

Attachment: test case with hyperlink and text field.

Comment 2

[Jesse Ruderman]

For simple textboxes, the current behavior is of questionable utility, but for contenteditable, it's kinda neat to be able to add a hyperlink (with correct anchor text and URL) with one drag.  On the other hand, right-clicking the bookmark to select "Copy" and then pasting into the contenteditable field works fine, so this might be worth fixing for the security benefit.

Comment 3

[Jesse Ruderman]

Attachment: contenteditable testcase

Comment 4

[Jesse Ruderman]

Btw, I'm testing Firefox trunk.  I have no idea whether any of that works in Firefox 2 ;)

Comment 5

[Gervase Markham [:gerv]]

Bug 451915 - move Firefox/Places bugs to Firefox/Bookmarks and History. Remove all bugspam from this move by filtering for the string "places-to-b-and-h".

In Thunderbird 3.0b, you do that as follows:
Tools | Message Filters
Make sure the correct account is selected. Click "New"
Conditions: Body   contains   places-to-b-and-h
Change the action to "Delete Message".
Select "Manually Run" from the dropdown at the top.
Click OK.

Select the filter in the list, make sure "Inbox" is selected at the bottom, and click "Run Now". This should delete all the bugspam. You can then delete the filter.

Gerv

Comment 6

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.