Bug 97722 - SECURITY - Form input field focus stealing using tabs + javascript
Summary: SECURITY - Form input field focus stealing using tabs + javascript
Status: RESOLVED FIXED
Alias: None
Product: konqueror
Classification: Applications
Component: general (show other bugs)
Version: unspecified
Platform: Gentoo Packages Linux
: NOR normal
Target Milestone: ---
Assignee: Konqueror Developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-01-23 16:20 UTC by marazm
Modified: 2005-02-07 23:23 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
patch for khtml (964 bytes, patch)
2005-01-24 11:19 UTC, Waldo Bastian
Details
tab-switching patch for khtml (832 bytes, patch)
2005-01-24 11:54 UTC, Waldo Bastian
Details
khtml patch #3 (909 bytes, patch)
2005-01-24 12:37 UTC, Waldo Bastian
Details
khtml patch #4 (2.26 KB, patch)
2005-01-24 17:44 UTC, Waldo Bastian
Details
khtml patch #5 (2.34 KB, patch)
2005-01-24 22:36 UTC, Waldo Bastian
Details

Note You need to log in before you can comment on or make changes to this bug.
Description marazm 2005-01-23 16:20:59 UTC
Version:            (using KDE KDE 3.3.2)
Installed from:    Gentoo Packages
Compiler:          gcc version 3.4.3 20041125 
OS:                Linux

Javascript fom another tab can steal input focus from other tabs. 
How to Reproduce: 
1) Open any page with some input field (page 1);
2) Open in new tab http://mans.tvnet.lv/mail/login.php?new_lang=en_US (This page uses Horde IMP) (page 2);
3) Switch back to in 1st step opened tab (page 1) and start to type in some text while page 2 continues and finishes to load.
4) Wola! Some text inputed in page 1 now is in page 2. Hitting ENTER key will submit form on page 2 with all entered information, but You will see page 1 on Your screen and think, that You are submiting info on page 1 :)

Reproducable: always. I often instead of my email login send some garbage from other pages (blog comments etc.).

This bug is similar to bug #87588 (http://bugs.kde.org/show_bug.cgi?id=87588), but more easy to reproduce. Oh, yeah, I was able to reproduce bug #87588 also, but not as good as in my example.
Comment 1 Waldo Bastian 2005-01-23 22:39:55 UTC
Yup, not nice.

One possible solution is to switch to the tab that asks the focus. We do that with popup messgaes already.

Another solution is to somehow check if another tab has the focus, perhaps we can check if the widget is visible and only set focus if it is?
Comment 2 Waldo Bastian 2005-01-24 11:19:35 UTC
Created attachment 9244 [details]
patch for khtml

Attached patch only sets focus when widget is visible.
Comment 3 Waldo Bastian 2005-01-24 11:35:19 UTC
Comment by Dirk Mueller:
I'm not sure.. you do want to be able to set the focus to the widget even if 
its not visible.. khtml will scroll to it then (e.g. tabbing through a page). 

you more want to bring up the tab into the front that has the input focus. 
that should be done generically I guess.
Comment 4 Waldo Bastian 2005-01-24 11:42:28 UTC
Yes, that's a good point, tabbing through a page indeed no longer seems to scroll to not-yet-visible widgets with the above patch.

Note that tabbing is a bit buggy, I can't tab out of the "Comments" field on the bugreports page ("Allow Tabulations" is unchecked)

I'll try to make a patch that gives focus to the tab. I'm not sure how annoying that is going to be.
Comment 5 Waldo Bastian 2005-01-24 11:54:35 UTC
Created attachment 9245 [details]
tab-switching patch for khtml

Patch to switch tabs. Unfortunately it flickers like hell because konqueror
switches tab even if the tab already has focus. I guess that's fixable.
Comment 6 Waldo Bastian 2005-01-24 12:21:16 UTC
Flicker fixed in CVS.

I'm a bit concerned that this switch-tab on focus request can be rather annoying though.

Corresponding issue in Mozilla:
https://bugzilla.mozilla.org/show_bug.cgi?id=124750
Comment 7 Waldo Bastian 2005-01-24 12:37:15 UTC
Created attachment 9246 [details]
khtml patch #3

patch #3 is an improvement of the first patch, instead of only giving focus
when the widget is visible, it only gives focus when the html-view is visible.

Note that with this patch the following Mozilla comment applies to Konqueror as
well:
"right now, background tab ignores focused items on load ...

a real fix should remember the item focused in a background and focus that item

when switching to the tab."
Comment 8 Waldo Bastian 2005-01-24 17:44:01 UTC
Created attachment 9259 [details]
khtml patch #4

New patch that includes the suggestion in #7
Comment 9 Waldo Bastian 2005-01-24 18:03:40 UTC
http://secunia.com/advisories/12712/
Comment 10 Waldo Bastian 2005-01-24 22:23:11 UTC
Patch #4 seems to have some issues where the text-area gets only "half" focus.
In particular when the textarea has focus and you then click in another part of the page.
Comment 11 Waldo Bastian 2005-01-24 22:36:30 UTC
Created attachment 9271 [details]
khtml patch #5

New patch that doesn't set focus on form element if khtmlview got focus due to
mouseclick
Comment 12 Waldo Bastian 2005-02-07 23:23:47 UTC
CVS commit by waba: 

Proper focus management with multiple tabs.
BUG: 97722


  M +8 -4      khtmlview.cpp   1.690
  M +4 -1      xml/dom_docimpl.cpp   1.307


--- kdelibs/khtml/khtmlview.cpp  #1.689:1.690
@@ -2828,4 +2828,9 @@ void KHTMLView::dropEvent( QDropEvent *e
 void KHTMLView::focusInEvent( QFocusEvent *e )
 {
+    DOM::NodeImpl* fn = m_part->xmlDocImpl() ? m_part->xmlDocImpl()->focusNode() : 0;
+    if (fn && fn->renderer() && fn->renderer()->isWidget() && 
+        (e->reason() != QFocusEvent::Mouse) &&
+        static_cast<khtml::RenderWidget*>(fn->renderer())->widget())
+        static_cast<khtml::RenderWidget*>(fn->renderer())->widget()->setFocus();
 #ifndef KHTML_NO_CARET
     // Restart blink frequency timer if it has been killed, but only on
@@ -2833,10 +2838,9 @@ void KHTMLView::focusInEvent( QFocusEven
     if (d->m_caretViewContext &&
         d->m_caretViewContext->freqTimerId == -1 &&
-        m_part->xmlDocImpl()) {
-        NodeImpl *caretNode = m_part->xmlDocImpl()->focusNode();
+        fn) {
         if (m_part->isCaretMode()
                 || m_part->isEditable()
-                || (caretNode && caretNode->renderer()
-                        && caretNode->renderer()->style()->userInput()
+                || (fn && fn->renderer()
+                        && fn->renderer()->style()->userInput()
                                 == UI_ENABLED)) {
             d->m_caretViewContext->freqTimerId = startTimer(500);

--- kdelibs/khtml/xml/dom_docimpl.cpp  #1.306:1.307
@@ -2075,7 +2075,10 @@ void DocumentImpl::setFocusNode(NodeImpl
                     view()->setFocus();
                 else if (static_cast<RenderWidget*>(m_focusNode->renderer())->widget())
+                {
+                    if (view()->isVisible())
                     static_cast<RenderWidget*>(m_focusNode->renderer())->widget()->setFocus();
             }
         }
+        }
 
         updateRendering();