av9ash/GitBugs huggingface dataset:
Bug: pushState immediately after replaceState with a query string has a race condition
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2023-06-12 04:45:20+00:00
Resolved: 2023-06-12 04:48:39+00:00

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/113.0

Steps to reproduce:

The following URL: http://firefox-bug-http.portools.com has the "Trigger" button behave incorrectly.

Here's the HTML:

<!doctype html>
<html>
<head>
</head>
<body>
<a href="#" id="trigger">Trigger (watch URL)</a>
<script type="text/javascript">
document.getElementById("trigger").addEventListener("click", function(event) {
	event.preventDefault();
	history.replaceState({"back":"/","current":"/a?to=/b","forward":"/b","replaced":false,"position":0,"scroll":null}, '', "http://firefox-bug-http.portools.com/a?to=/b");
history.pushState({"back":"/a?to=/b","current":"/b","forward":null,"replaced":false,"position":1,"scroll":null}, '', "http://firefox-bug-http.portools.com/b");

});
</script>
</body>
</html>


Actual results:

Clicking the "Trigger" button triggers a replaceState followed by a pushState immediately afterwards, but the address bar incorrectly shows the URL from the original replaceState (/a?to=/b), ignoring the pushState (which should have made the final URL /b).

The bug does not occur in any of the following contexts:

- In private browsing
- On localhost
- Sometimes (but inconsistently) on HTTPS
- If the query string is removed and the URL is /a instead of /a?to=/b
- If there is any delay between the replaceState and pushState

With any of the above, the address bar correctly shows /b after clicking "Trigger".


Expected results:

The URL should show /b following the final pushState. Firefox handles this correctly in private browsing, on localhost, on Chrome/Safari/etc.
Bug: Open redirect in Firefox QR Code Scanner
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-12 06:28:34+00:00
Resolved: 2024-05-30 18:10:49+00:00

The QR Code Scanner feature in the Firefox iOS app is vulnerable to an open redirect attack. This vulnerability allows an attacker to redirect users to malicious websites or URLs, potentially leading to phishing attacks or the disclosure of sensitive information.

## Steps To Reproduce:
1. Launch the Firefox iOS app.
2. Navigate to the Scan QR Code feature in the Home page URL  (Top Right Corner).
3. Create a QR Code with a specially crafted URL using https://www.the-qrcode-generator.com/
4. Scan a QR code that contains a specially crafted URL with an external domain.
5. Observe that the app redirects to the external domain without proper validation or user consent.

## Fix:
- The QR Code Scanner should validate the URL before redirecting users.
- Implement proper input validation and URL verification in the QR Code Scanner feature to prevent open redirect vulnerabilities.
- Ensure that redirects are only allowed to trusted internal pages or authorized external domains.
- Apply the same fix for iOS and Android

## Impact:
- This vulnerability could be exploited by attackers to trick users into visiting malicious websites, potentially leading to the theft of personal information, financial fraud, or other security risks.

Supporting materials/ references:
- https://hackerone.com/reports/1946534
Bug: Browser Download Spoofing
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-12 07:42:00+00:00
Resolved: 2024-05-30 18:10:51+00:00

Security Description:

Attack Vector: The attacker utilizes crafted HTML content to deceive users into believing they are downloading a legitimate file from java.com.

Spoofing Mechanism: The attacker's HTML content modifies the user interface to display a download bar and a trusted site URL in the address bar, creating a false sense of trust and legitimacy.
Backend Download Source: Instead of downloading the file from java.com, the victim unknowingly initiates a download from the attacker's server, potentially exposing them to malicious content.
Impact:

User Trust: By exploiting the user's trust in the browser and the perceived authenticity of the download source, the attacker can deceive victims into downloading and executing malicious files without their knowledge.

Malware Distribution: This vulnerability facilitates the distribution of malware, as victims believe they are downloading a trusted application but end up infecting their systems with malicious content.

Steps to Reproduce:
To reproduce this vulnerability, please follow these steps:

1. Craft an HTML page that resembles a download page for Java for Windows from java.com.
2. Host the malicious HTML page on an attacker-controlled server.
3. Send the victim a link to the malicious HTML page.
4. When the victim clicks the download link, the HTML content should initiate a download from the attacker's server while making it appear as if it is downloading from java.com.
5. Observe that the victim's browser displays a download bar and a trusted site URL in the address bar, further enhancing the illusion of a legitimate download.

It is crucial to address this vulnerability promptly to prevent the exploitation of user trust and the potential spread of malware
Bug: Add-on suggestion disappears after leaving the browser idle in the background
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2023-06-12 08:12:03+00:00
Resolved: 2023-06-24 00:41:24+00:00

**Found in**
* Fx 115.0b3

**Affected versions**
* Fx115.0b3
* Fx116.0a1

**Affected platforms**
* Windows 10

**Precondintions**
browser.urlbar.addons.featureGate set to true
browser.urlbar.suggest.addons set to true
browser.urlbar.suggest.quicksuggest.nonsponsored set to true

**Steps to reproduce**
1. Launch Firefox.
2. Write 'darker' in the address bar.
3. After the add-on suggestion is triggered, click anywhere in the page to dismiss the address bar drop-down.
4. Switch to another window(from another app like Chrome) and leave Firefox idle in the background for ~1 minute.
5. Click in the address bar.


**Expected result**
* Add-on suggestion is displayed.

**Actual result**
* No add-on suggestion is displayed.

**Regression range**
* Not a regression.

**Additional notes**
* After dismissing and clicking inside the address bar again, the add-on suggestion is displayed.
* Could not reproduce on ubuntu and macos.
Bug: Separator & spacing for "Search with" in case of google rich entities spacing depending on description
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-12 15:10:42+00:00
Resolved: 2023-07-12 01:26:21+00:00

**Found in**
* 115.0b4 

**Affected versions**
* 115.0b4
* 116.0a1 116.0a1 (2023-06-11)

**Tested platforms**
* Affected platforms:
         - Windows 10
         - Mac 11.7.4
         - Ubuntu 22.04
 
**Preconditions**
* Google as default search engine.
*browser.urlbar.richSuggestions.featureGate set to true


**Steps to reproduce**
1. Open Firefox
2. Run the following snippet in the Browser Console: `Services.prefs.getDefaultBranch("").setCharPref("browser.search.param.search_rich_suggestions", "fen")`
3. Type in address bar a query that will return rich entities with long description
4. Hoves over the search suggestion that has a long description  


**Expected result**
The separator + spacing betwen the search suggestion and "Search with engine" stays the same

**Actual result**
The separator + spacing betwen the search suggestion and "Search with engine" varies depending on the rich entity description (see #attachement)


**Regression range**
* N/A 

**Notes**
* The description needs to be longer than `search suggestion` + `space` + `separator` + `space`+ `Search with engine`
Bug: Show a Firefox icon when importing from Firefox profiles when running the migration wizard from the command line
Status: VERIFIED
Priority: --
Resolution: FIXED
Created: 2023-06-12 16:22:32+00:00
Resolved: 2023-07-25 06:45:54+00:00

We allow for migrating from existing Firefox profiles when running the migrator from the command line. Right now, Firefox profiles appear with the default favicon in the selection list. We should use a Firefox icon instead. See screenshot.
Bug: Reload button frequently flickers to stop
Status: NEW
Priority: P3
Created: 2023-06-12 17:16:14+00:00
Resolved: 2023-10-23 10:58:18+00:00

STR
- go to https://www.theweathernetwork.com/ca/weather/ontario/toronto

ER (as in Chrome)
- Reload/Stop button remains static on Reload

AR
- Reload/Stop button flickers between Reload and Stop
Bug: Broken info icon in confirm browser language settings message
Status: NEW
Priority: P3
Created: 2023-06-12 17:33:19+00:00
Resolved: 2023-06-22 18:56:23+00:00

We have a broken icon in a message we show to the user when they change their browser language to something that requires a restart to get applied. I was able to trigger this by trying to change my browser language to Hebrew, but I expect any RTL language would work.

It looks like we changed the icon to be an `<html:img>` from a XUL `<image>`, but we're still trying to set the image contents with `list-style-image` [here](https://searchfox.org/mozilla-central/source/toolkit/themes/shared/in-content/common-shared.css#1309). Switching to use `content` should fix things, but I'm not sure how widely used the `.message-bar-icon` class is given it's defined in `common-shared.css`.
Bug: Firefox Nightly Crashing
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-12 17:37:52+00:00
Resolved: 2023-06-12 21:26:58+00:00

User Agent: Mozilla/5.0 (Linux; Android 13; SM-G981U1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.41
Firefox for Android

Steps to reproduce:

Firefox Nightly crashes instantly, newest version, phone S20, android 13


Actual results:

Crashes instantly upon launch every time


Expected results:

Not crash
Bug: Embedded migration wizard never exits the loading state
Status: VERIFIED
Priority: --
Resolution: FIXED
Created: 2023-06-12 19:07:45+00:00
Resolved: 2023-07-21 13:29:19+00:00

Bug 1823537 moved the registration of the MigrationWizard JSWindowActor pair into MigrationUtils from BrowserGlue. This makes it so that the wizard can be used properly in the scenario where BrowserGlue hasn't yet had a chance to run (which is the case when we're showing the migration wizard on startup).

This, however, means that the actors aren't being registered unless MigrationUtils is loaded, which is no longer the case having moved the registration outside of BrowserGlue.

This means that the embedded migration wizard in about:welcome (and the spotlight experience in bug 1837051) will not work until that module loads and the registration occurs.
Bug: Firefox Nightly crashing instantly on latest 6/12/2023 update.
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-12 19:42:39+00:00
Resolved: 2023-06-12 21:28:20+00:00

User Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36
Firefox for Android

Steps to reproduce:

I opened Firefox.


Actual results:

It instantly crashed on the splash screen. (log below)


Expected results:

I should have been on either a previously opened tab or Firefox home. I have already reinstalled Firefox Nightly and cleared cache.
Bug: Media queries are ignored for `link` elements with `rel=icon`
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-13 09:25:11+00:00
Resolved: 2023-07-24 09:26:55+00:00

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/114.0

Steps to reproduce:

1. Load the attached test case in Firefox
2. Make the window less than 600px wide


Actual results:

Observe that the shortcut icon in the tab is white.


Expected results:

The shortcut icon should be black since that matches the media query 

    media="(max-width: 600px)"

Instead it just picks the last `rel=icon` link, even though the media query does not match.

Other notes:
- Same behavior regardless of what the width is when loading the page. 
- Same behavior with other media queries, like prefers-color-scheme
- I get the expected results with media queries `rel=stylesheet`
- I observe the expected results in Chrome 114.0.5735.106 on Mac
- I observe the same results as Firefox with Safari 16.4 (18615.1.26.110.1) on Mac, so maybe this isn't a bug? It is surprising that it works for `rel=stylesheet` and not `rel=icon`, though.
Bug: Screenshot Tool unable to "save full page" on ILIAS webpages
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-13 11:55:27+00:00
Resolved: 2023-06-15 18:53:31+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0

Steps to reproduce:

1. Launch Firefox and visit an ILIAS [1] website, e.g. https://ilias.uni-marburg.de
2. Right click on the website, select "Take screenshot"
3. Choose to "save full page" in the top right

The problem can be reproduced in a new profile and can be reproduced on the latest Nightly (Build ID 20230612211509).

[1]: https://www.ilias.de/


Actual results:

A screenshot of the visible area only was created.


Expected results:

A full page screenshot should be created.
Bug: Payment methods are doubled when performing the second import
Status: NEW
Priority: P3
Created: 2023-06-13 12:11:35+00:00
Resolved: 2023-06-22 18:38:51+00:00

**Found in**
115.0b4

**Affected versions**
115.0b4
116.0a1

**Tested platforms**
115.0b4
116.0a1
**Affected platforms**
Windows 10x64
macOS 10.15
**Unaffected platforms:** Payment methods are not available on Ubuntu

**Preconditions**
- have some saved credit cards inside Chrome on https://fill.dev/form/credit-card-simple
- clean profile
- browser.migrate.content-modal.enabled: true
- browser.migrate.content-modal.import-all.enabled: false
- browser.search.region: US

**Steps to reproduce**

1. Open Firefox and import Payment methods data from Chrome.
2. Open https://fill.dev/form/credit-card-simple and check that the credit card form is imported.
3. Import Payment methods from Chrome one more time.
4. Open https://fill.dev/form/credit-card-simple and check once again the credit card form.

**Expected result**
The import is correctly done, no entry gets doubled.

**Actual result**
The import is correctly done but the data is doubled after the second import.

**Regression range**
Most likely not a regression and was introduced when the Payment methods was added to the new migration wizard (bug 1826149).

**Severity**
S3

**Additional note**

Importing from the same Firefox profile multiple times does not result in duplicate data entries in Chrome.
Bug: gmail bypasses asking where to download files despite the setting being set to always ask
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-13 14:01:32+00:00
Resolved: 2023-09-01 12:20:41+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0

Steps to reproduce:

Open a PDF file in gmail, click the download button


Actual results:

The PDF file is immediately downloaded into the download folder in Windows.


Expected results:

Firefox should open a file dialog that allows the user to decide where the file will be placed.
Bug: Firefox ignore the settings-general-Application-PDF
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2023-06-13 15:10:21+00:00
Resolved: 2023-10-03 12:03:13+00:00

User Agent: Mozilla/5.0 (Linux; Android 12) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/113.0.5672.162 Mobile DuckDuckGo/5 Safari/537.36

Steps to reproduce:

Filing this report using android device of a bug with firefox 64bit for windows on my PC.
I made sure windows10 open PDF files with adobe as defualt and Firefox 64bit is default browser and firefox is updated version 114.0.1 English.
I changed the setting for PDF at settings-general-Applications-PDF to open a PDF file with external software (adobe)
I exit settings and restarted Firefox
Verify adobe PDF software is at the settings as I setup
At firefox64bit for windows I click a link to PDF files or click PDF file at gmail


Actual results:

It is open at Firefox not at adobe.


Expected results:

Open at adobe PDF.
Bug: <input type="number" /> input event emits empty string with decimal place
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-13 15:17:07+00:00
Resolved: 2023-06-13 15:39:02+00:00

Steps to reproduce:

Have an <input type="number" /> and listen to the input event, start typing a number then add a decimal place.


Actual results:

The input event emits empty string.


Expected results:

It should emit the number without the decimal place, for example if you type "12.", emit "12". 

This used to be the behaviour on Firefox 112.
Bug: Intermittent TV browser/base/content/test/protectionsUI/browser_protectionsUI_cookie_banner.js | This test exceeded the timeout threshold. It should be rewritten or split up. If that's not possible, use requestLongerTimeout(N), but only as a last resort.
Status: NEW
Priority: P5
Created: 2023-06-13 16:33:14+00:00
Resolved: 2023-06-19 06:37:28+00:00

**Filed by:** csabou [at] mozilla.com
**Parsed log:** https://treeherder.mozilla.org/logviewer?job_id=419142991&repo=autoland
**Full log:** https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/ZAFFWVefSTqxwCF0hHczUg/runs/0/artifacts/public/logs/live_backing.log
**Reftest URL:** https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/ZAFFWVefSTqxwCF0hHczUg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

---
```
[task 2023-06-13T15:37:48.625Z] 15:37:48     INFO - TEST-PASS | browser/base/content/test/protectionsUI/browser_protectionsUI_cookie_banner.js | object in event security.ui.protectionspopup#click#cookieb_toggle_on must match. - "cookieb_toggle_on" matches "cookieb_toggle_on" - 
[task 2023-06-13T15:37:48.625Z] 15:37:48     INFO - Buffered messages logged at 15:37:47
[task 2023-06-13T15:37:48.626Z] 15:37:48     INFO - Console message: [JavaScript Error: "TypeError: can't access property "QueryInterface", aWindow.docShell is null" {file: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs" line: 50}]
[task 2023-06-13T15:37:48.626Z] 15:37:48     INFO - Buffered messages logged at 15:37:48
[task 2023-06-13T15:37:48.626Z] 15:37:48     INFO - Leaving test bound test_section_toggle
[task 2023-06-13T15:37:48.627Z] 15:37:48     INFO - Buffered messages finished
[task 2023-06-13T15:37:48.627Z] 15:37:48     INFO - TEST-UNEXPECTED-FAIL | browser/base/content/test/protectionsUI/browser_protectionsUI_cookie_banner.js | This test exceeded the timeout threshold. It should be rewritten or split up. If that's not possible, use requestLongerTimeout(N), but only as a last resort. - 
[task 2023-06-13T15:37:48.627Z] 15:37:48     INFO - GECKO(2196) | MEMORY STAT | vsize 24362MB | residentFast 387MB | heapAllocated 193MB
[task 2023-06-13T15:37:48.628Z] 15:37:48     INFO - TEST-OK | browser/base/content/test/protectionsUI/browser_protectionsUI_cookie_banner.js | took 68682ms
[task 2023-06-13T15:37:48.628Z] 15:37:48     INFO - checking window state
[task 2023-06-13T15:37:48.628Z] 15:37:48     INFO - GECKO(2196) | Completed ShutdownLeaks collections in process 2196
[task 2023-06-13T15:37:48.628Z] 15:37:48     INFO - TEST-START | Shutdown
```
Bug: Firefox nightly keeps crashing when tried to open
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2023-06-13 17:59:01+00:00
Resolved: 2023-06-13 19:12:41+00:00

This started happening since 2 days ago. I'm using version 116.0a1 I couldn't create log from application, however I've included system log.

Android version: 12
Phone: Motorola g40 fusion
Processor: aarch64
Bug: The addon installation blocked icon looks out of place
Status: RESOLVED
Priority: P3
Resolution: FIXED
Created: 2023-06-13 19:26:15+00:00
Resolved: 2023-07-06 13:28:03+00:00

Steps to reproduce:
1) Navigate to https://www.zotero.org/download/connectors
2) Click the blue 'Install' button
3) In the extensions panel, click the caret next to the 'Don't Allow' button
4) Select 'Never Allow'

Actual results:
The icon looks out of place

Expected results:
The icon doesn't look out of place
Bug: Setting Qwant as the default engine on French Firefox doesn't change the UI properly
Status: RESOLVED
Priority: --
Resolution: WORKSFORME
Created: 2023-06-13 20:55:03+00:00
Resolved: 2023-06-13 21:06:43+00:00

If you change the default search engine to Qwant in the French version of Firefox, the URL bar still says "Search or enter Address" and the new tab page shows the generic magnifying glass.

The URL bar should say "Search with Qwant or enter address"

This works with every other engine except Qwant on both the URL bar and the new tab page.
Bug: Target language is reset if user clicks outside the translations panel
Status: VERIFIED
Priority: P3
Resolution: FIXED
Created: 2023-06-14 12:51:59+00:00
Resolved: 2024-10-02 12:50:55+00:00

Affected versions:
- Nightly 116.0a1/20230613152538
- Beta 115.0b5/20230613195413

Description:
If the user manually selects a target language in the translations panel and clicks outside the panel (or clicks the Cancel button), which causes the panel to close, the previously selected target language will be reset to the default language.

The issue occurs from the translations panel opened via the main menu “Translate page…” option as well.

Steps to reproduce:
1. Access https://es.wikipedia.org/wiki/Wikipedia:Portada
2. Open the Translations panel by clicking the Translations icon in the URL bar
3. Select a different target language other than the default one
4. Click outside the panel to close it
5. Reopen the panel
6. Notice the previously selected target language has been reset to the default language

Actual:
Selecting a target different language in the Translations panel and then closing the panel results in the target language being reset to default.

Expected:
The user selected target language should persist when closing and reopening the Translations panel.
Bug: [macOS] Safari history is not imported after selecting the browser folder to grant permission if there are no bookmarks inside Safari saved as well
Status: VERIFIED
Priority: P3
Resolution: FIXED
Created: 2023-06-14 13:38:56+00:00
Resolved: 2023-08-22 06:37:05+00:00

**Found in**
* 116.0a1 (20230614040639)

**Affected versions**
* 116.0a1 (20230614040639)















**Tested platforms**
* Affected platforms: macOS 12, macOS 13 arm
* Unaffected platforms: none

**Preconditions**
* new macOS profile, or profile that has no Safari granted permissions for importing
* have only History saved inside Safari browser with no user-created bookmarks


**Steps to reproduce**
1. Open Firefox and import History from Safari.
2. Select the Safari folder and asked and click open.




**Expected result**
* Safari History is imported.

**Actual result**
* Nothing happens, the file picker is opened again.

**Regression range**
* Importing with these preconditions regressed with bug 1236916. Bug 1837604 fixed importing from Safari where the permission was not granted but this issue exists now. I can't find if the actual regressor is bug 1236916 due to bug 1837604.


**Additional notes**
* Attached a screen recording: [link](https://drive.google.com/file/d/1LEx7Rdn2u2S81p2yB2kIGTI9cV4FEUfT/view?usp=sharing)
* S3 because is most likely that users that import from Safari will have saved bookmarks as well and not only History.
Bug: all page action icons in the address bar have a different height
Status: NEW
Priority: P5
Created: 2023-06-14 15:07:04+00:00
Resolved: 2023-08-08 08:18:58+00:00

As more and more page actions icons are added to the adress bar (bookmark star, reading mode, picture in picture mode, translate website) the size of the icons should be unified. As shown in the attached screenshot every icon has a different height. And it doesn't look great if all of these icons are visible in the address bar because the difference is noticeable. If you can't unify the height the icons should be vertically centered at least.

(The translation icon has also the wrong color but I will file a separate bug for that in the translations component).