Bugzilla

(In reply to Dominique Kaiser from comment #17)
> (In reply to :Gijs (he/him) from comment #16)
> 
> I think that's simply a typo in comment #13 - think "download" where they wrote "upload" - then it makes sense.

Well, I would expect overwriting files to prompt for confirmation.

> Also, are you trying to argue that overwriting a file is no or only a minor concern, just because it might "just only" happen in the "Downloads" folder?

No. I said:

> When we automatically save (without prompting) we will unique-ify the filename so we will never overwrite.

So in the default configuration, we would never overwrite. Full stop.

> If the user configures Firefox to always prompt to save, typically the OS dialog will (a) open in the default downloads directory (or previously used directory for the same origin) which won't contain such sensitive files, and then (b) complain if overwriting something, before letting the user confirm.

I don't personally use Linux as a daily driver, but on macOS and Windows the file picker dialog from the OS would prompt before overwriting. You noted elsewhere that it used to do that and now doesn't; that seems like a separate bug (that may have the same cause, or not, I'm not sure).

The note about "such sensitive files" was in relation to _uploads_ which were the subject of the regressing bugs (so sending files to a malicious webpage). It seems typical to me that people do not store sensitive data they upload in their default downloads location, or if they do, that predicting the filenames for the deliberate sake of a collision on the part of an attacker is going to be difficult. Relatively speaking, in the general case the harm from overwriting a file with garbage by an attacker is lower than uploading a sensitive file stored on disk to the attacker (even if I'm sure a counterexample could be constructed, of uploading something harmless and overwriting something terribly important - that won't be what the attacker is striving for in either uploads or downloads).

(In reply to Dominique Kaiser from comment #17)
> (In reply to :Gijs (he/him) from comment #16)
> 
> I think that's simply a typo in comment #13 - think "download" where they wrote "upload" - then it makes sense.

Well, I would expect overwriting files to prompt for confirmation.

> Also, are you trying to argue that overwriting a file is no or only a minor concern, just because it might "just only" happen in the "Downloads" folder?

No. I said:

> When we automatically save (without prompting) we will unique-ify the filename so we will never overwrite.

So in the default configuration, we would never overwrite. Full stop.

> If the user configures Firefox to always prompt to save, typically the OS dialog will (a) open in the default downloads directory (or previously used directory for the same origin) which won't contain such sensitive files, and then (b) complain if overwriting something, before letting the user confirm.

I don't personally use Linux as a daily driver, but on macOS and Windows the file picker dialog from the OS would prompt before overwriting. You noted elsewhere that it used to do that and now doesn't; that seems like a separate bug (that may have the same cause, or not, I'm not sure).

The note about "such sensitive files" was in relation to _uploads_ which were the subject of the regressing bugs (so sending files to a malicious webpage). It seems typical to me that people do not store sensitive data they upload in their default downloads location, or if they do, that predicting the filenames for the deliberate sake of a collision on the part of an attacker is going to be difficult. Relatively speaking, in the general case the harm from overwriting a file with garbage _by an attacker_ is lower than uploading a sensitive file stored on disk to the attacker (even if I'm sure a counterexample could be constructed, of uploading something harmless and overwriting something terribly important - that won't be what the attacker is striving for in either uploads or downloads).

Edit: perhaps a better clarification is that I was looking at this from the perspective of "harm that could be caused by a malicious attacker, on purpose, by means of clickjacking or similar techniques, and how it does/doesn't align with their goals", which is quite different from "acceptable behaviour for software in normal use, without any attackers involved". Overwriting files should warn, but if there e.g. wasn't clickjacking protection on the "are you sure you want to overwrite" prompt, that allows for less harm from an attacker than having no clickjacking protection on uploading files.