Bug 222398 – Activating Reader View permanently sets window.PublicKeyCredential to undefined

• Component: WebKit Misc.
• Status: RESOLVED CONFIGURATION CHANGED

[Matthew Miller (Cisco)]

Created attachment 421492 [details]
Video demonstrating the issue

I accidentally discovered today in Safari 14.0.3 that activating Reader View sets that tab's `window.PublicKeyCredential` to `undefined`. This permanently disables API's like WebAuthn in that tab, and the undefined value persists across page reloads. The webpage must be reloaded in a new tab to restore functionality.

I've attached a video demonstrating the issue, as well as a screenshot showing `window.PublicKeyCredential` returning `undefined` after having toggled Reader View with the keyboard shortcut Cmd + Shift + R.

[Matthew Miller (Cisco)]

Created attachment 421493 [details]
Screenshot of `window.PublicKeyCredential` returning `undefined` after Reader View toggle

[Alexey Proskuryakov]

I wonder if this is the only property affected!

[Matthew Miller (Cisco)]

I've come with a reproduction and instructions that reliably demonstrates the issue:

https://codepen.io/IAmKale/pen/oNYEEPX

I've also prepared this gist with the code above as a standalone HTML document if you wish to test this locally minus the added variance of CodePen's inner workings:

https://gist.github.com/MasterKale/e1372606296aaee7883288218a6e616f

[Chris Dumez]

Would seem like a Safari bug not a WebKit one?

[Radar WebKit Bug Importer]

<rdar://problem/74792804>

[Matthew Miller (Cisco)]

I played around a bit and identified a few other things that become undefined after toggling Safari's Reader View:

window.AuthenticatorAssertionResponse
window.AuthenticatorAttestationResponse
window.AuthenticatorResponse
window.Credential
window.CredentialsContainer
window.PublicKeyCredential

@Chris: I apologize if this wasn't the appropriate place to raise this issue, I didn't really know where else to post this to...that's on me for conflating the two projects.

[Chris Dumez]

(In reply to matthew from comment #6)
> I played around a bit and identified a few other things that become
> undefined after toggling Safari's Reader View:
> 
> window.AuthenticatorAssertionResponse
> window.AuthenticatorAttestationResponse
> window.AuthenticatorResponse
> window.Credential
> window.CredentialsContainer
> window.PublicKeyCredential
> 
> @Chris: I apologize if this wasn't the appropriate place to raise this
> issue, I didn't really know where else to post this to...that's on me for
> conflating the two projects.

In all fairness. I am not entirely sure if the bug is on WebKit side of Safari side. I would have thought the Safari side since reader mode is a Safari feature. That said, it is interesting that this is only impacting crypto/auth-related properties.

[Chris Dumez]

(In reply to Chris Dumez from comment #7)
> (In reply to matthew from comment #6)
> > I played around a bit and identified a few other things that become
> > undefined after toggling Safari's Reader View:
> > 
> > window.AuthenticatorAssertionResponse
> > window.AuthenticatorAttestationResponse
> > window.AuthenticatorResponse
> > window.Credential
> > window.CredentialsContainer
> > window.PublicKeyCredential
> > 
> > @Chris: I apologize if this wasn't the appropriate place to raise this
> > issue, I didn't really know where else to post this to...that's on me for
> > conflating the two projects.
> 
> In all fairness. I am not entirely sure if the bug is on WebKit side of
> Safari side. I would have thought the Safari side since reader mode is a
> Safari feature. That said, it is interesting that this is only impacting
> crypto/auth-related properties.

This could be an issue with interfaces marked as [SecureContext] in the IDL. My bet is that it impacts window.Cache & window.MediaDevices too. If so, this is likely a WebKit bindings bug.

[Matthew Miller (Cisco)]

(In reply to Chris Dumez from comment #8)
> This could be an issue with interfaces marked as [SecureContext] in the IDL.
> My bet is that it impacts window.Cache & window.MediaDevices too. If so,
> this is likely a WebKit bindings bug.

Cache and MediaDevices were both in the list of properties on window (as returned by `Object.getOwnPropertyNames(window)`) that I checked to see were undefined, but they remained defined.

That's not to say these properties weren't modified within as I didn't delve deeper than checking if they were defined or not.

[Chris Dumez]

I just went to:
https://www.cnn.com/2021/03/03/politics/stimulus-check-eligibility-senate-bill/index.html

1. Opened WebInspector and checked that window.PublicKeyCredential returns a Function
2. Activated Reader Mode
3. Deactivated Reader mode
4. Opened WebInspector and checked that window.PublicKeyCredential still returns a Function

There was no issue for me. Can you reproduce on this CNN article (ideally with Safari Technology Preview)? Or is the issue specific to the page you are testing somehow?

[Chris Dumez]

(In reply to Chris Dumez from comment #10)
> I just went to:
> https://www.cnn.com/2021/03/03/politics/stimulus-check-eligibility-senate-
> bill/index.html
> 
> 1. Opened WebInspector and checked that window.PublicKeyCredential returns a
> Function
> 2. Activated Reader Mode
> 3. Deactivated Reader mode
> 4. Opened WebInspector and checked that window.PublicKeyCredential still
> returns a Function
> 
> There was no issue for me. Can you reproduce on this CNN article (ideally
> with Safari Technology Preview)? Or is the issue specific to the page you
> are testing somehow?

I have also just tried https://codepen.io/IAmKale/pen/oNYEEPX. I see:
`window.PublicKeyCredential === undefined: false`

before and after reader mode, also after reloading. I am on using Safari Technology Preview 121 so it is possible this has been fixed after Safari 14.0.3.

Would you mind trying in Safari Technology Preview 121 to confirm if this has indeed been fixed or if I am just unable to reproduce the bug for some other reason?

Thanks!

[Matthew Miller (Cisco)]

> I have also just tried https://codepen.io/IAmKale/pen/oNYEEPX. I see:
> `window.PublicKeyCredential === undefined: false`
> 
> before and after reader mode, also after reloading. I am on using Safari
> Technology Preview 121 so it is possible this has been fixed after Safari
> 14.0.3.
> 
> Would you mind trying in Safari Technology Preview 121 to confirm if this
> has indeed been fixed or if I am just unable to reproduce the bug for some
> other reason?
> 
> Thanks!

I was unable to recreate the issue in Safari Technology Preview 121, so I suppose this will eventually stop being an issue whenever 121 hits Stable. That's good news :)

[Chris Dumez]

(In reply to matthew from comment #12)
> > I have also just tried https://codepen.io/IAmKale/pen/oNYEEPX. I see:
> > `window.PublicKeyCredential === undefined: false`
> > 
> > before and after reader mode, also after reloading. I am on using Safari
> > Technology Preview 121 so it is possible this has been fixed after Safari
> > 14.0.3.
> > 
> > Would you mind trying in Safari Technology Preview 121 to confirm if this
> > has indeed been fixed or if I am just unable to reproduce the bug for some
> > other reason?
> > 
> > Thanks!
> 
> I was unable to recreate the issue in Safari Technology Preview 121, so I
> suppose this will eventually stop being an issue whenever 121 hits Stable.
> That's good news :)

Excellent news! Thanks for testing. Closing this as this appear this was fixed in development, we just need to wait a bit for the fix to ship.