Can you attach a concrete PoC that shows this actually working? (In reply to Joren Afman from comment #0) > It should independently verify whether the URI is a file:// URI. I don't see how this makes a difference, the URI is child-supplied. The description of how `LaunchWithFile` works and the executable checks also seems mistaken / half-AI-slop. A concrete PoC would help determine what is actually happening and how we might mitigate.
Bug 2025890 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Can you attach a concrete PoC that shows this actually working? (In reply to Joren Afman from comment #0) > It should independently verify whether the URI is a file:// URI. I don't see how this makes a difference, the URI is child-supplied. The description of how `LaunchWithFile` works and the executable checks also seems mistaken / half-AI-slop (on non-Windows, `LaunchWithFile` will never directly launch the file, always trying to find a helper application to invoke to open it, and there are no executable checks in that part of the codepath). A concrete PoC would help determine what is actually happening and how we might mitigate.