Bug: Event listeners allow site to trick user into bookmarking different paths, hashes, or params
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2022-04-27 06:49:01+00:00
Resolved: 2022-04-29 14:00:36+00:00

# Summary
An event listener on a site can trigger when a user uses the bookmark shortcut (`ctrl` + `d` or `ctrl` + `shift` + `d`) to quickly push a new history state with a new URL path, hash, or URL parameter. This results in a different URL being bookmarked than the one the user intended. The site can then quickly use `window.history.back()` to revert the URL change and hide it from the user.

# How to Reproduce
This bug is reproducible 100% of the time and has been tested on Firefox 99.0.1 (build ID 20220411174855) and Nightly 101.0a1 on Windows 10.

Steps to reproduce:
1. Insert the following code into a webpage:
```javascript
// Assuming this is run on http://example.com/index
window.addEventListener("keydown", function (e) {
            if (e.ctrlKey && e.key == "d") {
                window.history.pushState({}, "", "http://example.com/about");
                window.history.back();
            }
});
```
2. Press the bookmark keyboard shortcut (`ctrl` + `d`) to bookmark the page 

# What Happens
Firefox bookmarks the URL indicated in `window.history.pushState` as opposed to the URL that was loaded prior to the call to `pushState`. The title of the bookmark also remains the same as the original URL, despite now pointing to a new URL. While this occurs, the address bar will briefly show the updated URL given in `.pushState` before quickly showing the old URL again.

In the example code provided, a user on `http://example.com/index` who uses the `ctrl` + `d` key combination to bookmark the page would instead bookmark `http://example.com/about`. The bookmark Firefox creates would also still have the title of `http://example.com/index`.

# What Should Happen
When the user presses `ctrl` + `d` to bookmark the page, `http://example.com/index` should be the URL that is bookmarked. At the very least, if bookmarking `http://example.com/about`  is the intended behavior, the title of the bookmark should display the title of `http://example.com/about`.

# Potential Harm
The main issue I see with this behavior is that the author of `http://example.com` could set up `http://example.com/about` to redirect to a malicious site, or simply show some other advertising/annoying content to the user that was not part of the original bookmarked page. When the user goes to visit the page they originally bookmarked, they could be redirected to some other site by `http://example.com/about` .

Another issue comes in the form of injected URL parameters. If the author of the example site were to use `window.history.pushState()` to push a special token generated uniquely for that user as a URL parameter (e.g. `http://example.com/about?t=userToken`), the site could potentially identify a user returning to the site specifically from a bookmark click by parsing the URL parameter and relating it to data already stored about that user. Although there might be legitimate uses for this as a business metric tool to determine how many users are visiting a page from a bookmark, it might also be used to correlate the traffic between two different sessions for the same user. If the user, for example, bookmarks the page using a VPN or proxy, causing the page to bookmark with a unique user token, then visits the page later without the VPN or proxy, the site would be able to use the injected token to determine the real IP address of the user who was browsing their site earlier.

This is my first bug report, so I apologize if it is incomplete or not technically considered a bug. Out of an abundance of caution, I am submitting this as a "security" bug since it contains example JavaScript that could be used by a site to insert a redirect into a user's bookmarks. Even if this isn't considered a direct security issue, it certainty would be annoying and could be abused.