262478 - Firefox allows websites to delete arbitrary data in the user's temp dir

Status: RESOLVED FIXED

(Toolkit :: Downloads API, defect)

Description

[Boris Zbarsky [:bzbarsky]]

See bug 240068 comment 27 paragraph 2.  See also bug 259708 for related discussion.

In short, a website can use a Content-Disposition header (or even a filename in
a URI), to cause Firefox to delete a file with any given name from the user's
temp directory.

This means that malicious websites can use Firefox to interfere with normal
operation of the user's computer (eg by wiping out X lock files, etc, stored in
/tmp).

Per bug 240068 comment 27, if Ben can tell me and biesi exactly what he wants
out of the back end, we would be perfectly happy to make changes so that the
file-removing code in question can be ditched.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

see also bug 240068 comment 37

Comment 2

[Robert Parenton]

Should this be marked security sensitive?  Bug 259708 dealt with something
similar and was marked as security sensitive.

Comment 3

[Boris Zbarsky [:bzbarsky]]

If I thought this should be security-sensitive, I would have marked it as such.
 My general feeling is that that flag is way overused.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Is this bug referring to the Remove(PR_TRUE) in nsDownloadManager::AddDownload?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yes, but the PR_TRUE is somewhat peripheral.  We just shouldn't be removing
files we might not "own", period.

Comment 6

[alanjstr]

There's a patch for this on ftp.mozilla.org, and it has been announced on
Slashdot.  So has this not been checked into branch and trunk yet?

Comment 7

[Boris Zbarsky [:bzbarsky]]

> There's a patch for this on ftp.mozilla.org

There is?

> and it has been announced on Slashdot

No, it hasn't.

You're confusing this bug with bug 259708, methinks.

Comment 8

[alanjstr]

that's entirely possible, but I can't see that one.

Comment 9

[Ben Goodger (use ben at mozilla dot org for email)]

/me looks

Comment 10

[Ben Goodger (use ben at mozilla dot org for email)]

I remember there being a reproducible bug with helper app launching that
prompted me to add the section of code in nsDownloadManager, but now with it
removed I cannot reproduce it. I've checked in the removal of the code and we'll
see if anything goes wrong this week.