Refreshing Cleared History in FireFox

 

Summary

Mozilla FireFox can keep a record of the sites visited by a user in the History. The user can clear the History at any time to remove the list of sites. While clearing the History, an error occurs where the browser "forgets" what page it is currently on, such that the user is unable to reload that page. In addition, after clearing the History, pressing the 'Refresh' button can bring the user to a page that was previously visited (and should have been erased when the History was cleared).

Application Description

Mozilla's FireFox is an Internet browser available for Linux, MacOS, and Windows. At the time of writing this presentation, FireFox was still pre-1.0 (meaning that it was still a preview release for testing purposes).

Test Design

This example demonstrates the use of Combination testing. In Combination testing, we test two or more variables at the same time. We do this type of testing both to observe variables in conjunction (so as to verify their interoperatibility) and to increase the productivity of our testing. For example, by testing three different variables together, we can verify whether any one variable has a damaging effect on the others and we can also verify that all three variables work correctly.

Users have come to expect certain features in their graphical Internet browsers. For example, when typing in the address of a site that they have previously visited, we know that the browser can complete the address for us. Similarly, if we close our browser window, we should be able to reopen the browser and be able to quickly find a page that we were on previously. Features like these are part of what is called the History. The History is a list of the sites that we have visited previously to make browsing quicker and easier.

In this presentation, we would like to combine to combine multiple variables together. However, we must recognize this: a variable is not always just a selection box or an input value, variables can be as broadly defined as different functions. The ways in which the History has been used and the ways in which it is combined with other functions demonstrates a variable as well. Therefore, what we will do is combine the History function with other functions in FireFox and examine what effects each function has on the others.

We expect that clearing the History in FireFox will not have any effect on the other functions (or rather that there are no adverse effects on other functions).

Performing the Test

  1. Launch Mozilla FireFox.
  2. To observe the settings for the History, click on Tools->Options:

  3. Once the Options window options, select the Privacy tab:

    Here we can either clear the History or set the number of days pages are remembered. Let's press 'Clear' to make sure that our History preferences are similar.

  4. Press 'OK' to leave the Options window.
  5. Now, generally browse the Internet to build up some listings in the History file. Try to visit about five or so different sites. For example, the sites I visited, in order, were:
    1. http://my.yahoo.com
    2. http://www.google.com
    3. http://www.winamp.com
    4. http://www.forteinc.com
    5. http://www.mandrakelinux.com
  6. After visiting sites, click on the 'Back' drop-down menu. This shows a listing of the sites that we have just come from, as listed in our History:

  7. Press the 'Back' button to move one site backward. This way, we have History to navigate both backward and forward.
  8. Let's see if we can navigate backward or forward if we clear the History. Click on Tools->Options, Privacy and press 'Clear' in the History option to clear the History.
  9. Press 'OK' to return to the main browser window.
  10. Once we return to the main browser window, we see that both the backward and forward navigation buttons are greyed-out, meaning that the browser has no recollection of any sites that we have already visited. Excellent, this is what we would have expected.

  11. Next, we will combine the History with the 'Refresh' button. Again, browse to a few different Internet sites to build up the History file (you can use the same sites as before).
  12. After visiting about five sites, press the 'Back' button once to move one site backward.
  13. Now click on Tools->Options, Privacy and press 'Clear' in the History option to clear the History.
  14. Press 'OK' to return to the main browser window.
  15. Good, our 'Refresh' button is not greyed-out, meaning that the button can be pressed to reload the current webpage that we are on. Press the 'Refresh' button to reload our current page:

  16. Nothing happens, the page does not reload. Press Ctrl-L to type in a web address and let's enter one of the sites we previously visited. Once there, notice that the backward and forward navigation buttons are still greyed-out. Press the 'Refresh' button to reload this page.

Results/Relevance

The first time we pressed 'Refresh', nothing happened. This time, after changing sites, when we press the reload button, it loads a completely different site (one of the previous sites that we visited that should have been forgotten when we cleared the History).

For example, using the five sites listed above, we finished browsing the web on MandrakeLinux's site. We then pressed back to return to the Forte, Inc. website. This is when we cleared the History. From this point on, we are essentially starting from scratch. None of our previous website browsing should be remembered by the browser. We are still on Forte, Inc.'s website, though, and pressing 'Refresh' performs no action. Next, we pressed Ctrl-L and entered a site that we had previously visited, such as WinAmp's site. We still cannot navigate forward or backward, but if we press 'Refresh' now, MandrakeLinux's site loads. It is odd that a different page was loaded when we pressed the 'Refresh' button, but it is even odder that the page that was loaded was one that we visited before clearing the History. The browser should not remember that we have been to that page.

This means that we have found a security flaw. Data that we have been told is erased has apparently not been erased. In addition, the 'Refresh' function seems to be adversely affected by the History. First, the browser was unable to reload the current page. Then, we navigated to a second page and pressed the 'Refresh' button again, and we were brought to a third page.

The issues with the 'Refresh' button represent an important bug (not necessarily critical), as many users may encounter it. However, when a user relies on data to be erased (and is informed that it has been erased), the fact that the information remains is an extremely critical bug. This bug is also critical because it may point to larger issues. It may not be a big security flaw if a page that was erased from the History is reloaded, but what it means is certainly important: it means that protected and private information is not being properly discarded, and therefore is at risk for being exploited by malicious users. Therefore, through Combination testing, we have found one important bug that took us directly to one critical bug.

Similar Tests/Additional Notes

More information about the bug in this presentation can be found in Mozilla's Bugzilla database.

During this time before FireFox is officially released, it is a Software Testing student's dream-come-true. Explore this pre-release software from many different testing angles and take advantage of this excellent showcase of beta software while it is available.

Configuration Notes

Testing Mozilla's FireFox v0.9.3 on:

Created 16 August 2004 for the CSTER

All images and written material ©Copyright Sam Oswald 2004

This work is licensed under the Creative Commons Attribution-ShareAlike License.
To view a copy of this license, visit
http://creativecommons.org/licenses/by-sa/2.0/
or send a letter to
Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305,
USA.