Closed Bug 327310 Opened 19 years ago Closed 11 years ago

Winfixer "pop-up" (resizeTo / moveTo / confirm) not blocked by Firefox

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Version:
1.5.0.x Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 402401

People

(Reporter: sichunlam, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug,
URL
)

Details

(Keywords: csectype-spoof, sec-low) 

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

The following code cannot be blocked by Firefox's pop-up blocker.  The only way to block the following pop-up is to turn off Javascript (turn OFF move or resize window, etc..)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Error Detected</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
</head>

<body bgcolor="white">
<script>
w=window.screen.width;
h=window.screen.height;

resizeTo(10,10);
moveTo(w,h);

</script>


<script>
confirm("NOTICE: If your computer has errors in the registry database or file system, it could cause unpredictable or erratic behavior, freezes and crashes. \nFixing these errors can increase your computer's performance and prevent data loss.\n\n\Would you like to install WinFixer 2006 to check your computer for free? (Recommended)");
moveTo(0,0);
resizeTo(w,h);
document.location.href='index.php?aid=fastukcpp_uk_en_ed2&lid=rr&ex=1&p=&ax=1';</script>


<div style="display:none; ">
<img src="https://stats1.reliablestats.com/stats.php?site_id=winfixer&aid=fastukcpp_uk_en_ed2&lid=rr_ok_ca&ref=&lp=true" width="1" height="1">
</div>
</body>
</html>



Reproducible: Always

Steps to Reproduce:
1. It happens on websites which uses affiliation/paid marketing services such as softwareprofit.com.
2. It launches a pop-up (or refreshes the page with a winfixer.com url - e.g. winfixer.com/download/2006/index.php?aid=fastukcpp_uk_en&lid=rr&ed=2&ex=1&ax=1
3. It happens.
Actual Results:  
Window resizes into what is essentially a pop-up window and generates new pop-ups through javascript call.

Expected Results:  
Pop-up should be blocked.

I suspect the only way to fix this problem (without disabling a huge number of sites by completely locking down javascript!) will be to form something permissions-based, by blocking sites like winfixer.com from being able to use javascript on a per-site basis.

Here is another example (with the text modified) to show that the problem lies with the javascript code.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Error Detected</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
</head>

<body bgcolor="white">
<script>
w=window.screen.width;
h=window.screen.height;

resizeTo(10,10);
moveTo(w,h);

</script>


<script>
confirm("WTF");
moveTo(0,0);
resizeTo(w,h);
document.location.href='about:mozilla';</script>

</body>
</html>
One might also wish to refer to the following posts on SpreadFirefox:

http://www.spreadfirefox.com/node/19920 - winfixer pop up?
http://www.spreadfirefox.com/node/17685 - Firefox Has Been Taken Over By Winfixer
Blocks: popups
URL: winfixer.com/download/2006/index.php?... → http://winfixer.com/download/2006/ind...
Depends on: 59314, 60323, alertloops, 186708
Summary: Pop-up blocker problem: Winfixer aggressive pop-up not blocked by Firefox → Winfixer "pop-up" (resizeTo / moveTo / confirm) not blocked by Firefox
Winfixer website seems to have been taken down; is there another site that shows this behaviour or a testcase?
There is one in the description. Here is a slightly different version (cross-platform, better HTML, window.location instead of document.location):
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Error Detected</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<script type="text/javascript" language="JavaScript">
w=window.screen.width;
h=window.screen.height;

resizeTo(10,10);
moveTo(w,h);

</script>
<script type="text/javascript" language="JavaScript">
confirm("WTF");
moveTo(0,0);
resizeTo(w,h);
// maybe "window.location.replace('about:mozilla');" would be better,
// doesn't break the back button, but not sure if it reproduces the bug
window.location.href='about:mozilla';</script>
</body>
</html>
This bug was reported on Firefox 2.x or older, which is no longer supported and will not be receiving any more updates. I strongly suggest that you update to Firefox 3.6.3 or later, update your plugins (flash, adobe, etc.), and retest in a new profile. If you still see the issue with the updated Firefox, please post here. Otherwise, please close as RESOLVED > WORKSFORME
http://www.mozilla.com
http://support.mozilla.com/kb/Managing+profiles
http://support.mozilla.com/kb/Safe+mode
Whiteboard: [CLOSEME 5-15-2010]
Version: unspecified → 1.5.0.x Branch
No reply, INCOMPLETE. Please retest with Firefox 3.6.3 or later and a new profile (http://support.mozilla.com/kb/Managing+profiles). If you continue to see this issue with the newest firefox and a new profile, then please comment on this bug.
Status: UNCONFIRMED → RESOLVED
Closed: 14 years ago
Resolution: --- → INCOMPLETE
Please don't be in such a hurry to mark security bugs as incomplete.
Status: RESOLVED → UNCONFIRMED
Keywords: csec-spoof, sec-low
Resolution: INCOMPLETE → ---
Whiteboard: [CLOSEME 5-15-2010]
Is this bug even still valid, or has its issue been resolved by the sands of time?
Status: UNCONFIRMED → RESOLVED
Closed: 14 years ago → 11 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.