989765 - Keyboard keys can be holded after having been push once (affect all programs, not only Firefox)

Status: UNCONFIRMED

(Core :: General, defect)

Description

[william.maller]

Attachment: poc 2 - hold key.html

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:28.0) Gecko/20100101 Firefox/28.0 (Beta/Release)
Build ID: 20140314220517

Steps to reproduce:

Check the attached file for a proof of concept (may work only on Windows)

After adding the following javascript lines in my page, and after pushing a specific key (like Alt, Ctrl, Windows-key or Shift), that key is considered as hold by the computer.

window.addEventListener('keydown', function(evt){
	alert(evt.keyCode);
	document.getElementById('field').focus();
});



Actual results:

For example if you press and release the 'Alt' key and then go to another program and press only the 'F4' key, the program will be closed.
Pushing the 'Alt' key again will stop the hold behaviour


Expected results:




--------------------------------
I checked the "Many users could be harmed" checkbox because I don't know if that proof of concept could be used for an exploit

Comment 1

[Daniel Veditz [:dveditz]]

I'm having trouble reproducing this (Win8 -- will try your version later). Does affect another browser like Chrome, too? Might be something on your system if so.

Comment 2

[william.maller]

I tried it on 3 different computers, 2 running Windows 7, 1 running Vista (all 32bits though).
I dont have Chrome installed, but I doesn't work on Internet Explorer, plus I'm pretty sure the problem doesn't come from my system.

I just tested it on Puppy Linux and it doesn't seem to work... Maybe it only works under Windows Vista/7?


And just to be sure that the problem doesn't come from my previous explanations, you can also try that key combination:
- load the attached page
- push the Ctrl key
- an alert popup will show, close it
- without changing tab or program, use your mouse-wheel. If the page is zoomed in or out the bug works. Changing tab and pushing the Ctrl key once again will stop the bug.

Comment 3

[Daniel Veditz [:dveditz]]

It sounds like you somehow turned on "Sticky Keys", a Windows accessibility feature to help people who have limited typing ability. It can often be triggered by repeatedly hitting the shift key and then a 'Y' which would be interpreted as a "Yes". You might be able to turn it off the same way, or go to the Ease of Access Center in Windows (part of the Control Panel).

Comment 4

[william.maller]

I've just checked and "Sticky Keys" is off on my computer, like all the others accessibility features.
Plus if it was that, I would have been able to reproduce that bug in any program, not only with the attached page and on firefox.

I tried it on a 4th different computer (Seven 64bits) yesterday and it gave me the same strange behaviour...