Opened 2 years ago

Last modified 2 years ago

#23431 new defect

Command+Shift+L unexpectedly Googles selected text in non-Tor browser

Reported by: elias Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

I am using Tor Browser 7.0.5 on OS X 10.12.6 and I noticed a bug.

If I select some text, and then press Command+Shift+L, instead of switching to a new Tor circuit, like the keyboard shortcut usually does, it opens Safari and does a Google search for what I selected.

Sometimes, even if I don't have any text selected, Command+Shift+L opens Safari with text I have selected a few minutes ago. I don't know what exactly is triggering this bug but I'm able to reliably reproduce it by selecting text.

I think this is a serious bug because it can cause the user to accidentally reveal sensitive information to the clearnet (with their Google session cookies if they are logged into Google).

Child Tickets

Attachments (1)

issue.png (40.4 KB) - added by Dbryrtfbcbhgf 2 years ago.

Download all attachments as: .zip

Change History (6)

comment:1 Changed 2 years ago by boklm

Is Command+Shift+L doing that in Tor Browser only, or is that also happening if you do it in other applications?

comment:2 Changed 2 years ago by Dbryrtfbcbhgf

Replying to elias:

I am using Tor Browser 7.0.5 on OS X 10.12.6 and I noticed a bug.

If I select some text, and then press Command+Shift+L, instead of switching to a new Tor circuit, like the keyboard shortcut usually does, it opens Safari and does a Google search for what I selected.

Sometimes, even if I don't have any text selected, Command+Shift+L opens Safari with text I have selected a few minutes ago. I don't know what exactly is triggering this bug but I'm able to reliably reproduce it by selecting text.

I think this is a serious bug because it can cause the user to accidentally reveal sensitive information to the clearnet (with their Google session cookies if they are logged into Google).

Command+Shift+L is a system shortcut enabled by default in macOS. To disable it go to system preferences->keyboard->shortcuts->services->and uncheck search with "any search engine". If possible Tor Browser should block this command from searching the selected text. I attached a photo showing the setting.
Tested on macOS 10.12.6 (16G29)

Last edited 2 years ago by Dbryrtfbcbhgf (previous) (diff)

Changed 2 years ago by Dbryrtfbcbhgf

Attachment: issue.png added

comment:3 Changed 2 years ago by elias

One more thing: I have been using Tor Browser for years, but I didn't notice this bug until a few months ago. I don't know exactly when it was introduced.

comment:4 Changed 2 years ago by Dbryrtfbcbhgf

Priority: Very HighMedium
Severity: CriticalNormal

elias look at https://trac.torproject.org/projects/tor/ticket/23431?cnum_edit=4#comment:2 , I do not this is a Critical severity issue, because it is a system shortcut the issue existed ever since the shortcut command was added to macOS. A temporary solution is to disable that shortcut until it is disabled in Tor browser, if that is even possible.

Last edited 2 years ago by Dbryrtfbcbhgf (previous) (diff)

comment:5 Changed 2 years ago by teor

Tor Browser could define a conflicting shortcut, and it might work.

But if you want to use Tor Browser in an OS that's designed not to leak your info, use Tails.

Note: See TracTickets for help on using tickets.