646761 - Site shrinks the browser into a tiny unusable box.

Status: VERIFIED INVALID

(Firefox :: General, defect)

Description

[Greg Hazel]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0

Visiting the website renders the Firefox window unusable.

Reproducible: Always

Steps to Reproduce:
1. Go to http://abz-antispyware.co.cc/fast-scan/

Actual Results:  
Firefox resizes to a tiny window and it is awful.

Expected Results:  
Firefox continues to be a useful webbrowser window and I can see my other tabs and such.

Comment 1

[Florin Strugariu [:Bebe]]

Hi

I'm sure that this is a virus page (at least this is what my antivirus says)
The source code of the website is encoded: 


><script language="JavaScript" type="text/javascript">
>var erp = new Array;
>erp[0] = 1013478509;
>erp[1] = 1814067309;
....
>var em = '';
>for(i=0;i<erp.length;i++){
>	tmp = erp[i];
>	if(Math.floor((tmp/Math.pow(256,3)))>0){
>		em += String.fromCharCode(Math.floor((tmp/Math.pow(256,3))));
>	};
>	tmp = tmp - (Math.floor((tmp/Math.pow(256,3))) * Math.pow(256,3));
>	if(Math.floor((tmp/Math.pow(256,2)))>0){
>		em += String.fromCharCode(Math.floor((tmp/Math.pow(256,2))));
>	};
>	tmp = tmp - (Math.floor((tmp/Math.pow(256,2))) * Math.pow(256,2));
>	if(Math.floor((tmp/Math.pow(256,1)))>0){
>		em += String.fromCharCode(Math.floor((tmp/Math.pow(256,1))));
>	};
>	tmp = tmp - (Math.floor((tmp/Math.pow(256,1))) * Math.pow(256,1));
>	if(Math.floor((tmp/Math.pow(256,0)))>0){
>		em += String.fromCharCode(Math.floor((tmp/Math.pow(256,0))));
>	};
>};
>document.write(em);
></script>



The page source after decoding contains the following commands :

>window.resizeTo(0,0);\r\n
>window.moveTo(width1,height1);
>....
>alert('Windows Security has found  critical process activity  on your  system and will perform fast scan of system  files');
>....
>window.moveTo(0,0);\r\n
>window.resizeTo(screen.width,screen.height);


There is a part of the loading process that the coder doesn't want you to see. But the alert prompt interrupts the loading process and waits for the user input. After that it maximizes the page.

So the firefox does what it is supposed to do. 
This is not a bug. Marking it as INVALID

Comment 2

[Greg Hazel]

Yet when I open the page in Chrome or IE, I get reasonable behavior.

Whatever allows the page to break Firefox is a bug... Firefox should fix this bug so that malicious pages like this one do not work.

Comment 3

[Tim (fmdeveloper)]

You can prevent sites from resizing the window by disabling that option -> see http://www.howtogeek.com/howto/internet/firefox/disable-web-site-window-resizing-in-firefox/ for a step by step guide

Comment 4

[Greg Hazel]

Perhaps that should be enabled by default?

Comment 5

[Tim (fmdeveloper)]

You can open a new enhancement request under the Firefox -> Preferences component

Comment 6

[Greg Hazel]

Done: https://bugzilla.mozilla.org/show_bug.cgi?id=650711