Re: Bug? Information disclosure

On Mon, Oct 20, 2008 at 6:23 PM, HJ van Rantwijk, MultiZilla
<[email protected]> wrote:
> Paul Hartman wrote:
>>
>> Open a website in a tab, then press control-B to open bookmarks and
>> double-click a bookmark to visit the site in the existing active tab.
>> The URL of the existing page will be sent to the bookmarked site as
>> the referrer. This could be potentially embarrassing or politically
>> dangerous. :P
>>
>> Is it a MultiZilla bug or seamonkey? I reported a very similar bug in
>> MultiZilla a few years ago, which HJ fixed immediately, so I suspect
>> it's maybe happening again in MultiZilla somewhere.
>>
>> I'm using:
>> Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.17) Gecko/20080924
>> MultiZilla/1.8.3.5i SeaMonkey/1.1.12
>>
>> Thanks,
>> Paul
>
> Paul,
>
> First, disable MultiZilla and try to reproduce the bug.
> BTW how are you testing this?
>
> Let me add some background information, this is how opening bookmarks work
> as in the program flow:
>
> BookmarksCommand.getBrowserTargetFromEvent()
> BookmarksCommand.shouldLoadTabInBackground()
> BookmarksCommand.shouldOpenInTab()
> BookmarksCommand.shouldLoadTabInBackground()
> BookmarksCommand.openOneBookmark()
> tabbrowser.addTab()
> tabbrowser.addOrInsertTab()
>
> Note: I do see this warning in my JS Error Console. You too?
>
> Warning: reference to undefined property
> aEvent.originalTarget.parentNode.parentNode.clickCount
> Source File:
> chrome://multiviews/content/bookmarks/bookmarksBindingOverlay.xul
> Line: 60
>
> And here's a link to SeaMonkey bookmarks.js file
> http://mxr.mozilla.org/seamonkey/source/suite/common/bookmarks/bookmarks.js#536
>
> Which, at first glance, doesn't seem to do anything wrong, but neither do we
> (MultiZilla). I guess I need to investigate this, which I will do right
> now..

Hi,

I noticed it by accident when I visited a site that happens to show
your referring page, and saw that it showed the previous page I had
been on. Like I said, the problem from years ago made me think of
MultiZilla first, plus MultiZilla has some referrer-related
functionality so I know it is handling the referrer it in some way at
some point. How it happens with certain bookmarks and not others, I
have no idea since I've not looked at the MultiZilla code. :)

>From my brief experiment:

It DOES send the current (soon-to-be previous) page as Referer when
you use the bookmark window (ctrl-B) or the bookmark sidebar.

It does NOT send a referrer when I use the bookmark drop-down menu or
the personal toolbar.

My MultiZilla is set to "Always send the page referrer", spoofing is
set to "Send Original Referrer". Setting it to "Links only" did not
change the behavior. "Do not send referrer" does correctly prevent it
from sending any referrer in every case described above.

You can use something like the Live HTTP Headers extension to see the
headers, or a proxy, or a web page that tells you your referrer such
as http://www.delorie.com/server/client-info.cgi (bookmark it and then
try my examples, see if it's just me).

I don't have any errors on my error console. Uninstall from Seamonkey
is not really easy... what's the best way to "disable" MultiZilla
enough that it won't contaminate things? (I mean, enough to rule it
out as the culprit). :)

Thanks,
Paul