784562 - Requesting to install a web app in the browser, quickly switching to a different web app, will have the pop-up appear in the different web app

Status: RESOLVED INVALID

(Firefox OS Graveyard :: General, defect)

Description

[Jason Smith [:jsmith]]

Steps:

1. Go to testmanifest.com in the browser
2. Request to install the web app on a weak connection
3. Before the pop-up appears, switch to a different web app
4. Wait a few seconds

Expected:

The pop-up should not appear in the context of the different web app, as the pop-up belongs under the browser context.

Actual:

The pop-up appears in the different web app.

Reasoning for flagging security:

Making a request for a prompt in one web app should not be able to be shown in a different web app, as that allows one web app to bring a pop-up to the foreground in a different web app. We should technically manage pop-ups on a per app basis.

Comment 1

[Justin Lebar (not reading bugmail)]

I don't think we need to protect this, because it's a security vulnerability only in unreleased code (b2g).

It's also possible that this is a gaia bug and not a platform bug at all.  In fact, I think that's kind of likely.

Comment 2

[Justin Lebar (not reading bugmail)]

dale/ben, can you check whether this is a bug in Gaia?  It sounds pretty likely to me.

Comment 3

[Jason Smith [:jsmith]]

(In reply to Justin Lebar [:jlebar] from comment #1)
> I don't think we need to protect this, because it's a security vulnerability
> only in unreleased code (b2g).

Could you clarify what you mean by unreleased code?

> 
> It's also possible that this is a gaia bug and not a platform bug at all. 
> In fact, I think that's kind of likely.

It probably is, although I'm wondering how I should flag security bugs for Gaia. Dietrich - How do we handle that?

Comment 4

[Justin Lebar (not reading bugmail)]

> Could you clarify what you mean by unreleased code?

No users would be harmed by an attacker being aware of this bug (presuming we fixed it before we released the phone, which we will).

So I don't think we need to hide this in the Gaia bug tracker.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Smells like a gaia bug to me.

Yay window.open.

Comment 6

[Jason Smith [:jsmith]]

Moved to Gaia here - https://github.com/mozilla-b2g/gaia/issues/3681.