Removing Saved Form Information in FireFox

 

Summary

Information stored while browsing in FireFox is stored in encrypted files within the install directory. When a user asks FireFox to delete this information, the files actually grow in size, meaning that the information might not actually be erased.

Application Description

Mozilla's FireFox is an Internet browser available for Linux, MacOS, and Windows. At the time of writing this presentation, FireFox was still pre-1.0 (meaning that it was still a preview release for testing purposes).

Test Design

This example demonstrates the use of Exploratory testing. "A good exploratory tester will write down test ideas and use them in later test cycles", notes James Bach in his paper What is Exploratory Testing, and this is a great introduction to perhaps the most important point of Exploratory testing: it is a set of tests (or a session of preliminary testing) that familiarizes the tester with the application in such a way that they are able to create stronger and more efficient tests for the application in the future.

In this presentation, we will be exploring Mozilla FireFox. Before we start exploring, we want to set some goals to give us direction and focus. First, let's outline what FireFox was designed to accomplish. FireFox is an Internet browser designed by the Mozilla Organization that is aimed at competing with Microsoft's Internet Explorer. For this reason, there are certain considerations that we will expect from FireFox. The browser must be highly compatible and user-friendly, be secure and have regular updates, and provide us with a user interface that is more unique and appealing than Internet Explorer's. We will therefore keep our eyes open for such things as:

  • Customizable interface
  • Compatibility
  • Easy-to-use and intuitive system
  • Ability to import settings from Internet Explorer
  • A high level of security and regular updates to the security system and the browser

To narrow our focus further for this presentation, let's concentrate on security. Specifically, let's examine how and where our private information is stored. Naturally, we expect that our information is stored in a secure place and that that information is protected in some way (such as being encrypted). Secondly, we also expect that when we want that information to be removed, we can do so safely, securely, and with confidence. In FireFox, before attempting to run any heavy tests on security, let's explore the security system and subsystems to determine what tests should be run and the areas on which to run those tests.

Performing the Test

  1. Open Mozilla FireFox.
  2. Before we move any further, let's look over the initial user interface. We want to take notes, perhaps on components we like or dislike, things we would change, areas that might be likely to contain bugs, and future tests. Notes like this will help us when we return to perform more dedicated testing on the application at a later time.

  3. Let's check Mozilla's website, also. There, we can look over some documentation, read about some of the less obvious features, and be made aware of any issues there might be with FireFox or security.
    1. On Mozilla's site, we find a great deal of information explaining Mozilla's goal to make FireFox the most secure browser available. On FireFox's main information page, it says "Firefox is the safer, faster, better web browser with exciting new features such as tabbed browsing and integrated search" and "Built with your Security in mind, Firefox keeps your computer safe from malicious spyware by not loading harmful ActiveX controls. A comprehensive set of privacy tools keep your online activity your business."
    2. Mozilla also has Bugzilla, a great tool for searching through a list of bugs, past and present. Here are the results for bugs with security in Bugzilla. We can quickly glance over these, but as there are hundreds of results, we may want to explore the program more first so as not to swamp ourselves with too much information that may be irrelevant.
  4. Let's take some notes on the initial settings of FireFox. We will compare these initial settings later with the changes that we make. We want to look for areas that concern personal information. For example, any options or information that pertains to forms, cookies, security profiles, history, and bookmarks are some of the more obvious concerns with personal information.
    1. Most of the settings for these options can be found under Edit->Preferences->Privacy:

    2. If we stop and think about this menu for a moment, we can surmise a few conclusions and maybe notice a few concerns. We see the different areas of security, and we can see that each one has a 'Clear' button accompanying it, which means that this information is saved somewhere. So, our first questions could be: where is this saved information stored and how is it protected? So, let's start our testing there. Let's find where the information is and look at how it is saved. Keep in mind that we are not necessarily delving into a full testing run now, we just want to take a look at these areas to become more familiar with them for future test writing. To examine how this data is saved, we must search on the Mozilla site to locate where our settings our saved.
      1. Unfortunately, we do not find anything on the website that specifically says what files our information is stored in, but we do find that our user information is stored in the directory /home/<username>/.mozilla/firefox/default.X46/. Let's look in that folder and attempt to determine what each of the files is for:

      2. Fortunately, all of the files seem fairly clearly labeled, and we can determine that our saved form information is located inside the file formhistory.dat. Upon attempting to open the file, we find that it is encrypted, as we would have expected. And, with a fresh install of FireFox, the file is a little less than 1 kilobyte in size, some of which appears to be unencrypted comments about the use of the file.
      3. Now, let's try to understand how this file works. Working with this one file should give us a fairly clear understanding of the rest of the files as well (such as our history or cookie files). Since we know little about this file now, and there does not appear to be any information about it on Mozilla's site, we will test with a brute force approach: we will store some information into forms, see how the file grows, and then ask FireFox to remove the information.
        1. First, let's take notes on our specifics. Our formhistory.dat file is what we assume holds our saved form information, and it is about 1 kilobyte in size. The file is encrypted, save for some unencrypted file comments. We should also take note of the file directory, as many other settings files appear to be stored in the same directory.
        2. Next, let's attempt to store some information to this file. Maximize FireFox.
        3. On the Navigation Bar of FireFox is the Google Search Bar:

        4. Type a search term into the form field and press 'Enter' on your keyboard to search for it in Google.
        5. Close FireFox and then reopen it.
        6. In the Google Search Bar, begin retyping your search term. Notice FireFox has saved the entry. If we check our formhistory.dat file size, it has grown by a few bytes:

        7. Now that we see how this works, let's store some significant amount of information into formhistory.dat so that we have a greater visual understanding of how the file works.
        8. Repeatedly enter long strings of characters into the Google Search Bar. We can either press and hold a single letter key on our keyboard or cut and paste text strings into the form field. Press 'Enter' on the keyboard after each string to store it into the formhistory.dat file.
        9. After some time, we find that we have built a sizeable formhistory.dat file, which means that the information that we have typed into the form field has been saved. Alternatively, this could have been a collection of usernames and passwords instead of random text:

        10. Now let's make sure that when we ask FireFox to remove the form data, that it is removed. Let's return to the Privacy section of the Preferences menu (Edit->Preferences->Privacy) and ask FireFox to clear the Saved Form Information:

        11. After clearing the Saved Form Information, let's close FireFox and look at the size of our formhistory.dat file.

Results/Relevance

Instead of returning to the 1 kilobyte size that it was originally, the formhistory.dat file actually grew in size. This appears to mean, though we can not be sure, that all of our saved form information that we asked FireFox to remove is actually still there. For security reasons and for reasons of personal privacy, this is obviously a critical issue. In this preliminary testing, we can not be sure that the information in this file can be exploited and whether or not it does in fact contain our original information, but the characteristic of the file size growth is worrying and alarming. We expected that our formhistory.dat file would simply be wiped clean upon asking FireFox to clear the saved form information.

We now have many possibilities for future testing. We could reopen FireFox and verify whether typing the original search strings into the Google Search Bar causes FireFox to display information that was supposed to be deleted. We could compare screenshots of the contents of formhistory.dat both before and after asking FireFox to clear the information. We might also perform tests on all of the other history files to check whether they also retain the information that was supposed to be deleted.

What have we learned from Exploratory testing? We know some areas that have bugs, and if we were on the testing staff, we know what areas we would test further after code changes. Also, we have become more familiar with many components of the application and probably have a much better idea how to administer new tests on FireFox.

Similar Tests/Additional Notes

For more information on the bug in this presentation, see the Mozilla Bugzilla database.

Take another component of FireFox, such as the Bookmark system, and perform some Exploratory testing.

Configuration Notes

Testing Mozilla's FireFox v0.9.3 on:

Created 20 September 2004 for the CSTER

All images and written material ©Copyright Sam Oswald 2004

This work is licensed under the Creative Commons Attribution-ShareAlike License.
To view a copy of this license, visit
http://creativecommons.org/licenses/by-sa/2.0/
or send a letter to
Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305,
USA.