255238 - creating a new profile in firefox (via profile manager) doesn't salt directory name

Status: RESOLVED FIXED

(Toolkit :: Startup and Profile System, defect)

Description

[Kathleen :Brade]

I've been doing lots of testing with seamonkey and firefox builds lately.  I
noticed that new profiles I created with firefox 0.9.3 on Windows do not have
salted directory names.

Steps:
* run firefox with profile manager
* delete all existing profiles
* create a new profile naming it:  default
* notice that the directory is named "default"

Comment 1

[Kathleen :Brade]

btw: blocking-aviary1.0 + is per shaver (via bsmedberg)

Comment 2

[Benjamin Smedberg]

Yeah, I've been meaning to fix this. It essentially involves adding salting to
http://lxr.mozilla.org/aviarybranch/source/toolkit/profile/content/createProfileWizard.js#80
and
http://lxr.mozilla.org/aviarybranch/source/toolkit/profile/content/createProfileWizard.js#141
(will need a little regexp-love there to replace the ==).

Comment 3

[Jesse Ruderman]

We should make salting less annyoing by using
  default-xxxxxxxx/ 
instead of 
  default/xxxxxxxx.slt/

Comment 4

[Benjamin Smedberg]

Yeah, we already do that for the default profile. This bug only affects profile
created from the UI.

Comment 5

[Brendan Eich [:brendan]]

Re: jesse's comment 3: Firefox already went with something like what you
suggest, but because of 8.3 mapping constraints, the combined profile+salt
directory name has only 3(!) chars of salt.  That's bug 256076.  We need to fix
that bug and this one for 1.0PR1.

/be

Comment 6

[Jesse Ruderman]

Why does 8.3 matter?  Is it because an attacker could bypass the salt using
"Defaul~1" otherwise?

Comment 7

[Benjamin Smedberg]

Patch in 256076 covers this as well.

Comment 8

[Benjamin Smedberg]

Fixed on trunk and branch