Red Hat Bugzilla – Bug 451385
Rogue websites can resize Firefox window
Last modified: 2013-07-02 22:35:35 EDT
Description of problem: Web sites can resize the firefox X11 window at will, even if multiple tabs are open. This resizing can often be intentionally annoying (resize to tiny window), or cause the firefox window to maximize itself on the desktop, hiding other windows. For example, http://www.vfdaily.com/culture/2008/blogopticon/index.html currently demonstrates this window-maximizing behavior. By default, web sites should NOT be able to control the main window, particularly if multiple tabs are open. Doing so presumes that a single website "owns" the browser window, which is not true. Version-Release number of selected component (if applicable): firefox-3.0-0.60.beta5.fc9.x86_64 How reproducible: always, with the right web sites Steps to Reproduce: 1. Open multiple tabs. 2. Make sure firefox X11 window does /not/ cover entire desktop. 3. Visit website such as the one above, and watch X11 window change size without user approval. Actual results: Window resized. Expected results: Window not resized, because it makes other tabs look horrible. Additional info:
Note that this problem occurs on firefox 2.x as well.
If this issue turns out to still be reproduceable in the latest updates for this Fedora Core release, please file a bug report in the the upstream bugzilla located at http://bugzilla.mozilla.org in the particular component. Once you've filed your bug report to the upstream bugzilla, if you paste the new bug URL here, Red Hat will continue to track the issue in the centralized upstream bug tracker, and will review any bug fixes that become available for consideration in future updates. Setting status to NEEDINFO, and awaiting upstream bug report URL for tracking. Thanks in advance.
This bug report indicates component firefox-3.0-0.60.beta5.fc9.x86_64 which is the latest available from Fedora 9 updates (but I assume you know this???)
Upstream bugzilla entry: https://bugzilla.mozilla.org/show_bug.cgi?id=439177
We have to really prioritize heavily about what we can do and what we have not enough resources for, and the latter should be send upstream as soon as possible. Unfortunately this is clearly in the latter camp. Closing as UPSTREAM against the bug you mentioned.
Is this not a security issue? Web site A can control the window of Web site B.
I really don't think so -- if it bothers you can avoid by changing the configuration of your Firefox. We can argue about defaults, but I don't think it is worthy. Letting to decide Christopher as the highest authority on Firefox matters.
It's not a security issue but a javascript bug...you can discuss it at https://bugzilla.mozilla.org/show_bug.cgi?id=144069