Firefox/metacity choke on loading page

[Eric Feliksik]

The page below contains sexually explicit images, so be warned.
It makes firefox/metacity choke, which really affects other apps, too.
Reproducable with the breezy pre-release live-cd as well.
This could be seen as a children protection mechanism, but it's probably just a
bug.

See http://dating.starttoppers.nl/

[Ian Jackson (ijackson)]

I have reproduced this. The effect is quite startling. The firefox window
starts appearing and disappearing, apparently as metacity stops and restarts
(perhaps it is crashing repeatedly?), and marches down the screen and to the
right. Then it stops leaving you with no wm.

This happens even with Javascript turned right off. I didn't even know this was
possible.

As the submitter says, the site is really quite unpleasant in approach and
contains excessively gynaecological image(s).

[Ian Jackson (ijackson)]

Created an attachment (id=4083)
Test case to reproduce the bug

This trivial HTML file demonstrates the bug too. The problem is the
overly-long <title>, which I think must be causing Firefox to set a window
title that crashes metacity.

[Ian Jackson (ijackson)]

This is related to
http://bugzilla.gnome.org/show_bug.cgi?id=315070
at gnome upstream. But it's not clear to me that that patch is correct.

I think this is a (minor) security issue: a bad website should not be able to
make the user's desktop unuseable.

[Daniel Holbach (dholbach)]

Just uploaded 2.12.1, which claims to fix the issue that was mentioned in the
upstream bug about it:

metacity (1:2.12.1-0ubuntu1) breezy; urgency=low

  * New upstream release:
    - Thanks to Ray Strode, Havoc Pennington, and Elijah Newren for
      improvements in this release.
    - Truncate ridiculously long titles to avoid crashing or letting the
      pager crash (Ray, Havoc, Elijah) [#315070] (Ubuntu: #15995)
    - Get the tabbing window outline to work with gtk+ 2.8.4 again
      (Elijah) [#317528] (Ubuntu: #16589)
    - Translations: Mahay Alam Khan (bn), Francisco Javier F. Serrador (es),
      Ivar Smolin (et), I\uffffaki Larra\uffffaga Murgoitio (eu), Luca
      Ferretti (it), Christian Rose (sv), Clytie Siddall (vi), Funda
      Wang (zh_CN)
  * debian/control.in:
    - Bumped Standards-Version.
  * debian/patches/003_bordersdrawingfix.patch:
    - dropped, fixed upstream.

 -- Daniel Holbach <email address hidden> Mon, 3 Oct 2005 22:44:28 +0200

Ian, could you check if it's alright?

[Ian Jackson (ijackson)]

Yes, the changes to metacity fix it for me.

However, I think additional precautions should be taken in firefox too. See my
report upstream, at:
 https://bugzilla.mozilla.org/show_bug.cgi?id=311052

There is a patch there which I will be applying in my upload.