764356 - WebGL exposes desktop window elements in canvas

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

I have noticed that during fuzzing the framebuffer methods that desktop elements of the underlying OS are exposed in the canvas. The content which is shown appears to be random after each reload of the page. Haven't looked more into this issue yet and am not certain whether it is possible to construct something which shows more than just fragments. Benoit mentioned that this is not intended and recommended to file a bug for this issue.

Benoit, the testcase also includes an commented out block which uses readPixels() which produces the same effect.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: Screenshot: Windows/Text

Comment 2

[Christoph Diehl [:posidron]]

Attachment: Screenshot: Desktop wallpaper

Comment 3

[Christoph Diehl [:posidron]]

Attachment: Screenshot: content of a folder

This screenshot makes it a bit more clear where you can actually read the file names in the SourceTree application.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

Can you elaborate on why you resolved as WORKSFORME? Is the bug not reproducible at all anymore?

What was the about:support of systems where it reproduced?

If reproducible, this is a good candidate for sg:high as it's about information leakage.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

(Sorry that I didn't react to this sooner. Since the switch to no-bugmail-by-default-for-secure bugs, I've been missing a few sec bugs like that. Should configure my bugmail properly).

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Note, this could be the same as bug 777457 which reproduced in Firefox 13 and "went away by itself" with the release of Firefox 14.

Comment 7

[Christoph Diehl [:posidron]]

Correct, it is not reproducible anymore. 

I have demo'ed this last week on our security work week where it was still reproducible with a trunk build. Since ~Thursday last week I was unable to reproduce this behavior. I have tested it today again with a new build but it seems to be fixed for now. 

If this behavior pop's up again I will re-open this bug.


System Information:

MacBook Pro 2012
CPU: 2.6 Ghz i7
RAM: 16GB

Vendor ID 0x10de
Device ID 0xfd5
WebGL Renderer: NVIDIA GeForce GT 650M 
OpenGL Engine: 2.1 NVIDIA-8.0.51
GPU Accelerated Windows: 1/1 OpenGL

ProductName:    Mac OS X
ProductVersion: 10.8 
BuildVersion:   12A269