Open
Bug 104303
Opened 23 years ago
Updated 13 years ago
script can make a window larger than the screen (Linux)
Categories
(SeaMonkey :: UI Design, defect)
Tracking
(Not tracked)
NEW
Future
People
(Reporter: security-bugs, Unassigned)
References
()
Details
(Keywords: sec-low, Whiteboard: [sg:low spoof] Suite version)
In Linux, running Enlightenment (probably other window managers too), you can
make a window larger than the screen, either by
window.open("someurl","windowname","width=5000,height=5000");
or by
self.resizeTo(5000,5000);
Not only is the window larger than the screen, it's potentially larger than the
total area of your virtual desktop.
This is related to bug 103454, about moving a window's titlebar off the screen.
It's a security problem, because it allows for window spoofing, not to mention
it slows my P3 to a crawl to the point of locking it up for a minute or so.
nsWindowWatcher.cpp contains some code which enforces safe window size and
position, but it doesn't enforce a maximum size. On Windows and Mac, this seems
to be enforced somewhere down in the paltform-specific widget code - you just
can't create a window larger than the screen. Not so on Linux. We could
potentially solve this by implementing maximum size restrictions (based on
screen size) in nsWindowWatcher.cpp. I'll try that and see if it's effective.
That may not be the best solution, this may be better handled down in the
Unix-specific code, I'm not sure.
Comment 1•23 years ago
|
||
One comment. There are plenty of good reasons to be able to make the window
bigger than screen size. The _user_ should be allowed to do it, using the
window manager to resize the window.
I'm not sure we can differentiate between a user-initiated resize and a
script-initiated one in the widget code (I hope not, actually, for the sake of
our code. :) ). If we can, by all means let's do this in widget code.
Otherwise, we need to filter these calls at a higher level.
I don't believe there is a way to get the virtual desktop size reliably, but if
there is limiting to the size of the virtual desktop seems like a reasonable
option to me.
Updated•23 years ago
|
QA Contact: sairuh → jrgm
Comment 2•23 years ago
|
||
This shouldn't be enforced in the widget code. The gtk code used to do this but
it caused a lot of embedding-related bugs. It's relatively simple to get that
information in the resizeTo() handler code and make sure that the window can't
be resized outside of the bounds of the window.
There's already code that gets the size of the virtual desktop in the widget
interfaces.
Comment 4•22 years ago
|
||
Also see bug 161903 [Add pref for overriding window size options on window.open()].
Comment 5•22 years ago
|
||
Update target milestone to 'Future' since this missed the 'mozilla1.1beta' train.
Target Milestone: mozilla1.1beta → Future
Comment 6•21 years ago
|
||
The bug/capability might actually be useful, sometimes. I've often wondered how
they make those nifty screenshots of looong webpages in magazines. This may be a
way - you can make a snapshot of a window, and I suppose that would include the
area of the window that is off-screen. Making the window so large manually seems
hard to do, but with a script it could be done, unless this bug is fixed.
(Of course, there's probably another way to do it, as I doubt they do it like
this in the magazines.)
Comment 7•21 years ago
|
||
Is this resolved after bug 239876?
Comment 9•21 years ago
|
||
The URL I just put in the URL bar still resizes the window with a build pulled
May 8 from CVS.
Comment 10•21 years ago
|
||
Ah. The first report talks about window.open or resize. The window.open problem
should be fixed, while the resize issue remains. It is likely that the patch
from bug 239876 could be adapted for this too.
Updated•20 years ago
|
Product: Core → Mozilla Application Suite
Comment 11•19 years ago
|
||
*** Bug 304123 has been marked as a duplicate of this bug. ***
Updated•19 years ago
|
Whiteboard: [sg:fix]
Updated•19 years ago
|
Whiteboard: [sg:fix] → [sg:spoof] Suite version
Updated•16 years ago
|
Whiteboard: [sg:spoof] Suite version → [sg:low spoof] Suite version
Comment 12•16 years ago
|
||
Still happening on firefox 3.0.2.
You need to log in
before you can comment on or make changes to this bug.
Description
•