Closed
Bug 500426
Opened 17 years ago
Closed 7 years ago
FF loses focus weirdly, interaction broken with new OS X Java dialog
Categories
(Core Graveyard :: Java-Implemented Plugins, defect)
Tracking
(Not tracked)
RESOLVED
WONTFIX
People
(Reporter: mozilla, Assigned: blackconnect)
References
()
Details
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/530.18 (KHTML, like Gecko) Version/4.0.1 Safari/530.18
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11
Since this update rolled out:
http://support.apple.com/kb/HT3632
Signed JARs dropped into the page will generate a new, slightly different dialog than what they used to generate, saying that an applet is requesting unrestricted access to the user's computer. When this dialog comes up, regardless of the choice you make (deny/allow) Firefox's entire window will lose focus, and clicking on it makes no difference. Hover events are responsive and some mouse events work, but clicks in text inputs will not focus them, including the address bar.
On OS X this is a great vector for a simple denial of service attack on Firefox users, since it does not require the user to accept the dialog for the JAR, only to see it.
I discovered one way to break out of this state is to use command+t to create a new tab.
Note that any time you accept/deny a cert, it will be cached until you quit and restart Firefox, so this will only repro once per session.
Reproducible: Always
Steps to Reproduce:
1.Visit my test page here and click the "insert applet" button:
http://mantup.com/chris/p/java/test.html
2. Deny or accept the cert, doesn't matter (the applet is harmless, it's 1 line that calls console.log(1), but to be safe you might as well deny it)
3. Behold, broken browser
Actual Results:
Browser is in a nigh-unusable state as it is behaving like it has no focus and mouse events are doing wonky things
Expected Results:
Browser shouldn't do this; should continue functioning as normal after the Java security dialog closes
You can generate your own jar to test this on a mac like this:
echo 'import java.applet.*;
import netscape.javascript.*;
public class TestApplet extends Applet {
public void init() {
JSObject window = JSObject.getWindow(this);
if (window != null) {
window.eval("console.log(1);");
}
}
}' > TestApplet.java
javac TestApplet.java -classpath ".:/Library/Java/Home/lib/plugin.jar"
keytool -genkey -alias honk -keystore keystore -validity 365 # Fill out some fake data and save it
jar cvf TestApplet.jar TestApplet.class
jarsigner -keystore keystore -storepass <whatever> TestApplet.jar honk
Then for the HTML:
<html>
<head>
<script type="text/javascript">
function b() {
document.getElementById("dazzle").innerHTML =
'<object id="honk" ' +
'classid="java:TestApplet" ' +
'type="application/x-java-applet" ' +
'archive="TestApplet.jar" ' +
'height="0" width="0">' +
'<param name="archive" value="TestApplet.jar" />' +
'</object>';
}
</script>
</head>
<body>
<div id="dazzle"></div>
<input type="text" value="edit me" />
<input type="button" onclick="b();" value="insert applet" />
</html>
|
||
Updated•17 years ago
|
Assignee: nobody → blackconnect
Component: General → Java-Implemented Plugins
Product: Firefox → Core
QA Contact: general → blackconnect
Version: unspecified → 1.9.1 Branch
|
|
||
Comment 1•17 years ago
|
||
(confirming, as it includes a testcase, but please note that I haven't actually taken the time to reproduce it yet :) )
Status: UNCONFIRMED → NEW
Ever confirmed: true
This repros for me in 3.5RC3 as well.
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5
I have come across this issue independently in FF 3.5.2
Opening a new window or tab corrects the loose of focus.
|
||
Updated•14 years ago
|
Product: Core → Core Graveyard
|
||
Comment 4•7 years ago
|
||
Dead component, closing all bugs in it.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
You need to log in
before you can comment on or make changes to this bug.
Description
•