174522 - "registry.dat" should be plain text like "pluginreg.dat"

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Profile: BackEnd, defect)

Description

[Henrik Gemal]

I see a lot of people having problems with their profiles. Having 
the "registry.dat" in plaintext like "pluginreg.dat" could help some of the 
problems.

More important it could also help external programs parse the profile data. 
The company I work for currently have dropped support for Mozilla since it's 
almost impossible to located the profile data for by parsing the regitry.dat

Comment 1

[Conrad Carlen (not reading bugmail)]

I completely agree. Though instead of being some custom format text file, it
should be XML. I've already started on the DTD for it.

Comment 2

[Henrik Gemal]

Cool! Way to go! Looking forward to this!

Comment 3

[OstGote!]

What about the dependencies with older versions like Mozilla 1.0, Netscape 6.x,
and 7.0, which use the same (binary) file?

Comment 4

[Henrik Gemal]

There could be a one time convert function, that converted the .dat file to a
.xml file. Perhaps this could be put together with the fact that Netscape and
Mozilla should be using different profiles.
The new file should just be called "profiles.xml"

Comment 5

[Conrad Carlen (not reading bugmail)]

Need to fix bug 175919 along with this.

Comment 6

[Jason Bassford]

Removing duped dependency.

Comment 7

[Conrad Carlen (not reading bugmail)]

Mass move of 1.3a bugs -> 1.4a.

Comment 8

[Peter Lairo]

Sorry if stupid question, but doesn't this negate purpose of salt directory?

Comment 9

[Conrad Carlen (not reading bugmail)]

Balancing workload :-/

Comment 10

[Matthias Versen [:Matti]]

Peter: no, why should it ? 

Comment 11

[Peter Lairo]

Well, the the registry.dat file is in a "known" location (unsalted). If it were
plain text and its contents referred to the salted directory, it could be easily
read and the "hacker" could find anything within the salted directory. Thus, the
salted directory would be useless. I thought the salted directory was that
hackers (viruses) couldn't easily find the profile data. With the registry
showing the "way" to the profile data, it woud be "easy" to find ones way into
the salted directory. No?

Comment 12

[Conrad Carlen (not reading bugmail)]

  Since the registry file would have to be parsed in order to read a profile
location from it, having it in a binary format doesn't make it safe from attack,
just slightly harder.
  But, anyway, if an attacker has the ability to open and parse a text file on
your drive, that attacker could just as easily delete your hard drive, salt or not.

Comment 13

[Vidar Haarr (not reading bugmail)]

ccarlen, could you attach the preliminary DTD file ? I'd like to have a look :)

Comment 14

[Conrad Carlen (not reading bugmail)]

Attachment: prelim DTD and sample of XML registry

Sure - here's the initial format I did. If it looks familiar, it is. It's based
on CodeWarrior XML projects.

Comment 15

[Lewis Jardine]

Is it possible for an attacker to somehow insert javascript into the registry
file, which could then be executed by giving the user a link to the registry
file itself? 

Why does javascript loaded from a file have more permissions anyway?

Comment 16

[Cyrus Patel]

Conrad, whats the status on your work?

I'm already drooling in anticipation of this fix. :)

ps: Until your fix gets merged, is there a standalone editor to edit registry.dat?
pps: Does the current registry.dat already support relative paths? 

Comment 17

[Oleg Sidletskiy]

> Until your fix gets merged, is there a standalone editor to edit registry.dat?
try this: http://www.alain.knaff.lu/howto/MozillaCustomization/

Comment 18

[:aceman]

The target milestone as a bit off :)

Comment 19

[:aceman]

The target milestone is a bit off :)

Comment 20

[rosen rosenov]

Is there a way to change the location of registry.dat in Windows?

Comment 21

[WADA:World Anti-bad-Duping Agency]

I've found that Firefox 0.9 and Thunderbird 0.7 uses "profile.ini", text base
profile index file, instead of "registry.dat".
Why "profile.ini" is still not implemented for Mozilla Suite?  

Comment 22

[Benjamin Smedberg]

File is no more.