av9ash/GitBugs huggingface dataset:
Bug: Firefox view icon persistent focus after restoring the default settings in customize mode
Status: NEW
Priority: P2
Created: 2023-09-12 14:00:04+00:00
Resolved: 2023-09-13 12:15:00+00:00

**Found in**
- Firefox 119.0a1

**Affected versions**
- Firefox 119.0a1

**Tested platforms**
- Affected platforms: macOS 13.5.2, Ubuntu 22.04, Windows 10

**Steps to reproduce**
1. Launch Firefox and access Firefox View
2. Right click on Firefox view on the tab strip and select "Remove from toolbar"
3. Access customize toolbar and select "Restore Defaults"
4. Select Done

**Expected result**
- Firefox View icon is not focused

**Actual result**
- Firefox View will stay focused until clicked again

**Regression range**
- Will see for a regression

**Additional notes**
- The issue can be seen in the following [attachment](https://drive.google.com/file/d/1-hfHE0pIA--JyIBLLfS6qSEo-7N-3Frp/view?usp=sharing)
- The issue will only reproduce if Firefox View is focused in the moment of its removal from the toolbar.
Bug: requestIdleCallback in the TranslationsParent is not a function error
Status: RESOLVED
Priority: P3
Resolution: FIXED
Created: 2023-09-12 14:18:54+00:00
Resolved: 2023-09-14 15:26:10+00:00

`JavaScript error: resource://gre/actors/TranslationsParent.sys.mjs, line 226: TypeError: this.browsingContext.top.currentWindowGlobal.requestIdleCallback is not a function`

It appears this is not always available, or maybe even never available.
Bug: Title bar is barely visible in Customize mode if system theme is set to dark
Status: VERIFIED
Priority: P1
Resolution: FIXED
Created: 2023-09-12 14:23:58+00:00
Resolved: 2023-10-02 09:54:05+00:00

**Found in**
- Firefox 119.0a1

**Affected versions**
- Firefox 119.0a1

**Tested platforms**
- Affected platforms: Windows 11, macOS 13.5.2
- Unaffected platforms: Ubuntu 22.04

**Preconditions**
- Have the system theme set to dark

**Steps to reproduce**
1. Launch Firefox with a clean profile
2. Access customize mode
3. Look over the Title bar option

**Expected result**
- The Title bar option is visible

**Actual result**
- The Title bar option is barely visible

**Regression range**
- Will see for a regression

**Additional notes**
- The issue can be seen in the attachment
- This only happens if the system theme is set to Dark and Firefox has the Auto theme. Will not reproduce if dark is manually selected from Themes within Firefox.
Bug: PDF messages are opened immediately
Status: RESOLVED
Priority: --
Resolution: WONTFIX
Created: 2023-09-12 14:26:32+00:00
Resolved: 2023-09-12 15:24:34+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0

Steps to reproduce:

Showing a PDF file with a PDF-annotation


Actual results:

PDF annotations are opened immediately when the PDF file is displayed in Firefox. You have to click on it to close it.

This is very annoying.


Expected results:

The previous behavior (open only when hovering or clicking) was much better.
Bug: Spoofing "Site Info" panel (on own site)
Status: RESOLVED
Priority: --
Resolution: WONTFIX
Created: 2023-09-12 18:37:01+00:00
Resolved: 2023-10-24 13:32:57+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

Steps to reproduce:

Title
=====
Content Spoofing in Page Info Bubble.

Description
===========
A vulnerability has been identified that allows an attacker to spoof the content of the `Page Info Bubble` on a specifically designed website. This vulnerability arises from the triggering of the `blur` event when clicking the `Page Info Bubble` button, enabling an attacker to control the context and execute malicious JavaScript code when the event is activated. This opens the door to a range of threats, including carrying out malicious actions on the victim, presenting false information such as fraudulent certificates or misleading security statements, and even inducing the victim to download malware or perform other harmful actions.

The vulnerability is exploited when the victim clicks the `Page Info Bubble` button, which triggers the `blur` event and thus allows the attacker to manipulate the context. An attacker can use JavaScript code to modify the content of the `Page Info Bubble` window and present false or misleading information to the victim.

Please observe the proof of concept (POC) video named `poc.mp4.` In this video, it demonstrates how a visitor to a website experiences the presentation of false information when clicking the `Page Info Bubble` button.

Steps to Reproduce
==================
It is important to note that the following steps achieve the spoofing of the `Page Info Bubble` panel using CSS and JavaScript. However, it is essential to keep in mind that, as I am not an expert in CSS, the result may not be identical to that of the video due to variations in screen resolutions and other factors. Nevertheless, I consider achieving a completely accurate result is not essential for a simple proof of concept.

1. Set up the Ruby interpreter on your system and install the Sinatra gem.
2. Download the attached file named `files.zip.`
3. Choose a directory on your system and proceed to unzip the contents of `files.zip` into it.
4. In a terminal emulator, start the server and listen for connections by executing the following command: `ruby server.rb localhost 80`.
5. Now, go to the address `http://localhost/site` in your web browser. Then, click the `Page Info Bubble` button and observe how the content spoofing takes place.

Impact
======
An attacker could manipulate the content of the `Page Info Bubble` on a specially designed website with the purpose of deceiving the victim, leading them to take unwanted actions such as downloading malware, disclosing confidential information, or executing malicious actions.
Bug: option to add translation exceptions is totally missing
Status: RESOLVED
Priority: --
Resolution: WONTFIX
Created: 2023-09-12 19:41:11+00:00
Resolved: 2023-09-12 20:46:50+00:00

+++ This bug was initially created as a clone of Bug #1850774 +++

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0

Steps to reproduce:

1. set "browser.translations.enable" to true
2. visit about:preferences#general
3. click on "Exceptions"


Actual results:

There is no way to add a translation-exception, see screenshot


Expected results:

There should *definitely* be a button to add a translation-exception!
Bug: [Desktop] Shopping sidebar says "Unreliable reviews removed" despite not actually removing any reviews
Status: VERIFIED
Priority: P3
Resolution: FIXED
Created: 2023-09-12 20:29:55+00:00
Resolved: 2024-07-09 07:37:32+00:00

The shopping sidebar currently says...
```
Unreliable reviews removed
```
...under its adjusted rating.


I **think** that statement implicitly means "...when generating this Adjusted rating".  But that's not at all clear right now, and it feels like the abbreviated wording may be over-promising.  Users may interpret it to mean that we've literally removed the unreliable ratings from the page that we're showing to the user -- but I don't think we have?

In particular:
- "Unreliable reviews removed" sounds like we've potentially updated the rating count that's shown in the page alongside the star rating.  So, a user might misinterpret Amazon's `50 ratings` in a product's rating-badge to mean "There are 50 ratings **that Firefox judges to be reliable**, since Firefox clearly says it has removed the unreliable reviews".
 
- "Unreliable reviews removed" sounds a lot like we're saying we've removed the text of these reviews from the display of the product's reviews -- so the user might feel like they can freely read through product-reviews, and trust that the ones they're seeing are legitimate.

Perhaps we should reword this to avoid confusion & over-promising?
Bug: Sidebar goes back to loading state if closed and then re-opened
Status: VERIFIED
Priority: P1
Resolution: FIXED
Created: 2023-09-12 21:11:55+00:00
Resolved: 2023-09-15 11:34:33+00:00

STR:
1. Load a valid product page. [Example](https://www.amazon.com/introducing-amazon-fire-tv-32-inch-2-series-hd-smart-tv/dp/B09N6F9NV3/ref=psdc_6459737011_t1_B0BCMRRKRX)
2. Make sure sidebar is open and there is data
3. Press the shopping URLbar icon to close the sidebar
4. Re-open again using the URLbar icon

Expected: data should be visible on the sidebar after opening the sidebar
Actual: data is stuck in loading state. Refresh is needed to show analysis on sidebar

Notes:
- Also does not work if the sidebar is hidden already when viewing a new product page and then reopening the sidebar

Regression log:
- https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7ddcc5c570857b59a8ca28d15053b56adee3751a&tochange=b2453b43eee06d8a6ec112c23a639dbdafffe9d5
Bug: startup Crash in [@ mozilla::freestanding::SharedSection::Layout::Resolve | ... ], part 2
Status: VERIFIED
Priority: P2
Resolution: FIXED
Created: 2023-09-12 21:47:21+00:00
Resolved: 2023-10-19 08:09:09+00:00

+++ This bug was initially created as a clone of Bug #1850969 +++

Startup crash in Firefox 117.0.

This has been addressed in two patches in bug 1850969; this bug exists for administrative reasons only, to ease a later potential uplift of the possibly-riskier second patch.
Bug: Tabs encounter issues loading page or loosing url
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2023-09-13 05:49:12+00:00
Resolved: 2024-04-01 12:22:50+00:00

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0

Steps to reproduce:

Searching for something via the url bar



Actual results:

Tab load indefinitively, nothing appears 
Tampermonkey do not work / load anymore 
Some already opened tabs "loose " their content. Url lost. Copy url give a "about:blank"


Expected results:

have a search result 
tampermoneky should work 
opened tab should reload their page

firefox dev edition :118.0b7 (64 bits)
Bug: firefox didn't restore previous session event if the parameter is checked
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2023-09-13 08:56:38+00:00
Resolved: 2023-11-13 12:32:54+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0

Steps to reproduce:

firefox didn't restore previous session event if the parameter is checked



Actual results:

firefox didn't restore previous session event if the parameter is checked



Expected results:

when i start firefox it need to restore previous session
Bug: Firefox ESR does not respect policy "Allowed Sites" for whitelist extension installation websites when default policy is set to "disable"
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2023-09-13 10:45:32+00:00
Resolved: 2023-10-02 16:52:32+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.76

Steps to reproduce:

Disabled add-on installs from websites via Group Policy. (Default install policy).
Enabled add-on installations from addons.mozilla.org via Group Policy "Allowed Sites".




Actual results:

Cannot install any add-ons from addons.mozilla.org nor anywhere else.


Expected results:

Allow add-on installation from addons.mozilla.org and disable all other sites.
Bug: Resizing the window doesn't resize the content (page, navbar & tabs)
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2023-09-13 10:51:21+00:00
Resolved: 2023-10-20 09:14:22+00:00

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0

Steps to reproduce:

The problem happens after an amount of time browsing. 
I've seen the problem several times across two computers (Both with gnome wayland). I initially thought it was a Wayland bug, but I've only seen this bug with Firefox. 


Actual results:

When the window is resized, the content (both the page and Firefox's UI) is not updated to reflect the change. It just overflows to the bottom and the right of the window. It's fixed by restarting the browser. The visible content is still interactable and work as expected.


Expected results:

The window resize should cause the content to be resized.
Bug: A blank sidebar is displayed for a split second after disabling the sidebar on one tab and switching to other tabs where the sidebar was opened
Status: VERIFIED
Priority: P1
Resolution: FIXED
Created: 2023-09-13 12:12:41+00:00
Resolved: 2023-09-21 15:13:55+00:00

**Found in**
* 119.0a1 (2023-09-12)


**Affected versions**
* 119.0a1 (2023-09-12)






**Tested platforms**
* Affected platforms: Ubuntu 20, macOS 12, Windows 10x64
* Unaffected platforms: none

**Preconditions**
* browser.shopping.experience2023.enabled:true
* browser.shopping.experience2023.optedIn:1

**Steps to reproduce**
1. Open multiple Amazon products in different tabs.
2. Close the sidebar by clicking the `X` button or the URL icon button.
3. Switch to other tabs.

**Expected result** 
* No sidebar transition is displayed.

**Actual result**
* A blank sidebar is displayed for a split second when switching to other tabs.

**Regression**
* Not a regression.






**Additional notes**
* Attached a screen recording.
Bug: Tabs next to Customize mode get unusable when dragged to create a new window
Status: VERIFIED
Priority: --
Resolution: FIXED
Created: 2023-09-13 13:10:16+00:00
Resolved: 2024-01-26 09:45:26+00:00

**Found in**
- Firefox 119.0a1

**Affected versions**
- Firefox 118.0b8
- Firefox 119.0a1

**Tested platforms**
- Affected platforms: Windows 11, macOS 14, Ubuntu 22.04

**Steps to reproduce**
1. Launch Firefox
2. Have some tabs with random webpages loaded
3. Access Customize mode
4. Drag the tab next to the Customize mode to create a new window with it

**Expected result**
- The window is created and the tab remains loaded

**Actual result**
- The window is created, but the tab with the website is no longer usable and the Customize tab window is focused over the newly created window

**Regression range**
- Will see for a regression

**Additional notes**
- The issue can be seen in the following [attachment](https://drive.google.com/file/d/1mrhfB7ulP8n5XpAQLC6bA1k-qLRNoLxd/view?usp=sharing)
- Only the tabs next to the Customize mode are affected
Bug: Results Menu button has no distinct active state (it's the same as on hover)
Status: NEW
Priority: P5
Created: 2023-09-13 13:13:18+00:00
Resolved: 2023-11-30 11:28:44+00:00

**Notes**
* Screencast attached; 
* Suggesting S4 severity;

**Found in**
* Beta 118.0b8;

**Affected versions**
* Nightly 119.0a1;
* Beta 118.0b8;

**Tested platforms**
* macOS 12;
* Windows 10;
* Ubuntu 22;


**Affected platforms**
* macOS 12;
* Windows 10;
* Ubuntu 22;



**Unaffected platforms**
* N/A; 

**Steps to reproduce**
1. Launch Firefox.
2. Focus Address Bar.
3. Type any string in the Address Bar and submit the search.
4. Open a new tab and type the first few letters from the previously searched string.
5. Observe the results menu. 
6.  Hover over the result menu button.
7.  Click on the result menu button.

**Expected result**
* Hover and Click states should have different behaviours.


**Actual result**
* Hover and Click states have the same behaviour. 


**Regression range**
* Not a regression.
Bug: Some tests await on BrowserTestUtils.loadURIString, that doesn't wait for load
Status: RESOLVED
Priority: --
Resolution: FIXED
Created: 2023-09-13 13:17:13+00:00
Resolved: 2024-01-14 09:32:54+00:00

This is quite confusing, BrowserTestUtils.loadURIString() doesn't wait for load, but the javadoc is unclear about that, and some tests are awaiting on it.

I initially thought to make it wait, and then consumers could optionally use the promise... through awaiting requires to add listeners that potentially may remain at the end of the test, if the test doesn't await for the promise, and that could cause other intermittents.
Different tests have different needs so just awaiting is not good for all of them.

Thus, I'm thinking to rename BrowserTestUtils.loadURIString() to BrowserTestUtils.startLoadingURIString(), that should make a bit clearer it's only starting the load, not awaiting for its completion... plus updating its javadoc.

This is actually causing intermittents, like bug 1775820.
Bug: [Experiment] The “about:addons” page is not opened if the hyperlink from the total number of matched extensions after import is clicked
Status: VERIFIED
Priority: --
Resolution: FIXED
Created: 2023-09-13 14:02:29+00:00
Resolved: 2024-06-13 17:43:43+00:00

**[Affected versions]:**
- Firefox Release 117.0.1 (Build ID: 20230912013654)

**[Affected Platforms]:**
- Windows 10 x64.
- Windows 11 x64.

**[Prerequisites]:**
- Have the Firefox browser installed on your computer.
- Have the Chrome browser installed on the computer.
- Have some extensions installed in Chrome that are available in Firefox also.


**[Steps to reproduce]:**
1. Create a new profile and open it.
2. Navigate to the “about:config” page and set the “nimbus.debug” pref to true.
3. Navigate to the “about:studies?optin_slug=nuo-extensions-migration-in-embedded-import-wizard-in-117&optin_branch=treatment-a&optin_collection=nimbus-preview” link in order to enroll in the Treatment A branch of the experiment.
4. Navigate to the “about:welcome” page and go through the Onboarding screens until the “Import Browser Data” screen is displayed.
5. Click the “Import” button from the “Import Browser Data” screen
6. Click the number of the matched extensions that is displayed on the “Data Imported Successfully” screen.
7. Observe the behavior.


**[Expected result]:**
 - The “about:addons” page is opened if the hyperlink from the total number of the matched extensions is clicked.

**[Actual result]:**
- The “about:addons” page is not opened if the hyperlink from the total number of the matched extensions is clicked.


**[Notes]:**
- This issue is also reproducible in the case where Chrome has some extensions that are available in Firefox and some that aren't available in Firefox.
- Attaching a screen recording of the issue:
Bug: Block auto-translate language from doing nonsensical translations
Status: RESOLVED
Priority: P1
Resolution: FIXED
Created: 2023-09-13 14:28:51+00:00
Resolved: 2023-09-14 16:09:25+00:00

While going through the telemetry data with Erik, we found a few clients that had spurious es -> es translations. We dug into it, and it was all related to a combination of using the auto-translation feature, changing language packs, and removing your web content languages. I don't have a precise STR for it.

The fix for it is to treat the stored preferences for auto translate as an untrusted list of languages, and validating them during the `maybeOfferTranslate`.

As a bonus, I'll add logic to ensure when we call `TranslationParent.translate` we will check that valid language pairs are received in case there are other regressions in the future.
Bug: [foxfooding] Fakespot analyzer progress card presents option to "Download on Firefox"
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2023-09-13 16:22:08+00:00
Resolved: 2024-05-29 15:52:09+00:00

STR:

1) Get to a product that needs an updated Fakespot review analysis (yellow 'Updates available" box at top of the Review checker.
2) Click the link for "Launch analyzer on Fakespot.com"
3) In the new tab that opens, on the right, under the Fakespot Review Grade, click the "Reanalyze >"  button.

Observed results: 
In the Fakespot Analyzer, at the bottom of the progress card, is a button, "Download on Firefox", that takes you to the Fakespot Addon for Firefox.

Expected results:
No option to download the Fakespot add-on should be given since the product is built into Firefox.
Bug: Investigate why ads_hidden is sometimes unequal to ads_loaded
Status: VERIFIED
Priority: P2
Resolution: FIXED
Created: 2023-09-13 16:30:42+00:00
Resolved: 2023-11-07 10:24:49+00:00

Blocked ads should have the same number of loaded ads as ad blockers hide them from users.

Data Science let us know that in a sample of data, they found 2.5% of the time, `ads_hidden` (when it had a non-zero number) had a number lower than `ads_loaded` for the corresponding component. 

In that sample, it only happened with `ad_link` and `ad_sidebar`. 

We should investigate 1) which search provider this is happening with, and 2) why this is happening.
Bug: Malicious File Downloads via detecting header differences between the <embed> Tag and "save video" context menu item
Status: NEW
Priority: P3
Created: 2023-09-13 16:31:12+00:00
Resolved: 2024-05-30 18:14:18+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36

Steps to reproduce:

Title
======
Malicious File Downloads via the <embed> Tag in HTML.

Description
===========
A vulnerability has been detected in video playback and downloading using the HTML `<embed>` tag. When this tag is used to embed a video or opened in a new tab, a network request is generated that includes the `Upgrade-Insecure-Requests` and `Referer` headers with different values in both requests. However, it's interesting to note that when choosing the `Save Video As...` option in the browser's context menu, the network request is made without including these headers.

This allows an attacker to manipulate the context of the video download request to send different responses, potentially causing the victim to view the video normally but download a malicious file instead of the expected video when choosing to download it.

Please watch the proof of concept video (poc.mp4) that illustrates how a victim who is viewing a video normally can download malware by opting to use the browser's context menu for downloading.

Recommended Solution
====================
It is recommended to modify the behavior of the video download request to include the same headers that are sent when the video is embedded via a tag or opened in a new tab. This will help mitigate the risk of an attacker exploiting this difference to send malicious files.

Steps to Reproduce
==================
1. Set up the Ruby interpreter on your system and install the Sinatra gem.
2. Download the attached file named `files.zip`.
3. Choose a directory on your system and proceed to unzip the contents of `files.zip` into it.
4. Go to the directory where you unzipped the files and move a binary file to the `./videos` folder, renaming it as `movie.exe`.
5. In a terminal emulator, start the server and listen for connections by running the following command: `ruby server.rb localhost 80`.
6. Now, go to the address `http://localhost` in your web browser.
7. Download the video via the web browser's context menu and observe how the binary or malicious file is obtained.

Impact
======
An attacker could exploit this vulnerability to manipulate the context of the video download request, potentially allowing the victim to download a malicious file, such as malware, instead of the legitimate video when choosing to download. This malicious action could jeopardize the security and integrity of the victim's systems, as the user expects to download a harmless video file but could receive a file designed to harm or compromise their device.
Bug: windows 8 version for firefox not syncing anything with my pc running win 10, same account connected on both devices and everything synced, but nothing happens
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2023-09-13 18:39:12+00:00
Resolved: 2024-01-29 15:21:37+00:00

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Steps to reproduce:

i just followed the steps to sync, i downloaded the firefox version for win 8, logged in into my firefox acc, then tried to sync this with my win 10 pc which is also logged in to the same frefox acc, everything synced etc. but nothing happens



Actual results:

no bookmarks, history, or anything else has been transfered/synced from the pc to the laptop or vice versa. it is showing up as synced but nothing actually happens



Expected results:

the bookmarks, saved pws and other stuff should have transfered over. unfortunately i was relying on this to work and i am now traveling far away from my actual pc with a lot of log ins missing since the sync feature isn't working