Pop-up blocker string in Portuguese can lead to confusion about whether URL refers to pop up, or page that triggered it (Was: Hijacking Clicks)
Reported by
adri...@brztec.com,
Aug 17
|
|||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 Steps to reproduce the problem: Hi team. I found a way to hijack clicks, tricking users to click in trusted URLs but openning others destinations. 1. Open the attached poc. 2. Mouse over the link and you see https://www.google.com showing that the correct link. 3. Click in the link and a new tab will be openned with https://www.marvel.com. 4. Click in the parent tab and click in the pop-up blocker icon and you will see https://www.google.com has been blocked. *** PoC Code *** <a id="link1" name="link1" href="https://www.google.com" onclick="onMouseClick()" target="_blank">www.google.com</a> <script> function onMouseClick(){ var newdestiny = window.open("about:blank", "link1"); newdestiny.document.write('<script>document.location.href="https://www.marvel.com";</' + 'script>'); setTimeout(function(){ //newdestiny.close(); }, 1000); } </script> What is the expected behavior? The window opened from window.open() should be blocked and not the destiny from href attribute. What went wrong? Apparently chrome makes confusion about which destination should be blocked. Did this work before? N/A Chrome version: 63.0.3239.132 Channel: n/a OS Version: 10.0 Flash Version:
,
Aug 17
,
Aug 20
Hi! I made more tests and the strange behavior occurs only in some javascripts events. For example, when event is onmousedown the href value isn't related in pop-up blocker, but if the event is onmouseup or onclick it is will be related in pop-up blocker. In onwheel or onmousemove href isn't related but all pop-ups will be blocked. <a id="link5" name="link5" href="https://twitter.com" onmousedown="onMouseClick2();" target="_blank">twitter.com</a> <script> function onMouseClick2(){ var popup3 = window.open('https://www.marvel.com', '_blank'); popup1 = window.open('https://www.dccomics.com', '_blank'); } </script>
,
Aug 23
Hi Mellie, Need you help on this bug. Thanks!
,
Aug 28
hi, this is a bit confusing for our localization team. Would you be able to help us identify where exactly the translation issue is coming from so we can more easily identify it in TC? Thanks a lot!
,
Aug 29
https://bugs.chromium.org/p/chromium/issues/detail?id=875260#c1 (Comment 1) suggests the localization issue: However, it seems this might be a localization issue, in the English version, the text shows as "Pop-ups blocked: <list of pop up URLS>", while in Portuguese it is shown as "Os seguintes pop-ups foram bloqueados nesta pagina: <list of pop up URLS>" which translates to "The following pop-ups have been blocked in this page: <list of pop up URLS>", so I can understand that can be confusing, particularly when only one URL is shown, it looks like the blocked URL refers to the site that triggered the popup. Adding the localization component (and renaming the issue) regarding the confusing string.
,
Aug 29
Looking in the translation console 6815484526221703469 for Chrome seems to be the corresponding message (no link due to this being a public bug). I do not see the corresponding Portuguese translation identified by #1. CC'ing carlosil@chromium.org for further clarification.
,
Aug 29
That's strange, I also checked https://cs.chromium.org/chromium/src/chrome/app/resources/generated_resources_pt-BR.xtb and https://cs.chromium.org/chromium/src/chrome/app/resources/generated_resources_pt-PT.xtb and I can't see the string that shows up in the picture, but 'Pop-ups bloqueados' which lines up with the English string, I wonder if this was changed in a version newer than what the original reporter was using. If so, this is probably a wontfix.
,
Aug 30
Hey Joshua, could you have a look at TC now that we have more details?
,
Oct 2
|
|||||||||||||||
►
Sign in to add a comment |
|||||||||||||||
Comment 1 by carlosil@chromium.org
, Aug 17Components: UI>Localization UI>Browser>PopupBlocker
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam OS-Android OS-Chrome OS-Fuchsia OS-Linux OS-Mac Type-Bug
Summary: Pop-up blocker string in Portuguese can lead to confusion about whether URL refers to pop up, or page that triggered it (Was: Hijacking Clicks) (was: Hijacking Clicks)