1067467 - Windows security zone being set on downloaded files when browser.download.manager.scanWhenDone is set to false

Status: RESOLVED INVALID

(Toolkit :: Downloads API, defect)

Description

[Ira Malinich]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Build ID: 20140911151253

Steps to reproduce:

1. Set browser.download.manager.scanWhenDone to False in about:config.
2. Download a file from an external web site using Save Link As... in the context menu.
3. Check the General tab of the file properties dialogue for the downloaded file.


Actual results:

"This file came from another computer and might be blocked to help protect this computer." message followed by an "unblock" button.  This indicates that an NTFS alternate data streamed called Zone.Identifier has been added to mark it as an untrustworthy file.


Expected results:

There should have been no message or button, indicating that no such ADS was added to the file.

From Firefox 4.0 through Firefox 28, the browser.download.manager.scanWhenDone value controlled both the launching of virus scans and the marking of files in this manner, after the download has completed.  Sometime between Firefox 28 and Firefox 31 the option appears to have become ignored.

Comment 1

[Matthias Versen [:Matti]]

based on the description this could be a result of bug 952961.

Comment 2

[Masatoshi Kimura [:emk]]

Actually that's bug 858234.
A brief history:
1. Bug 858234 stopped using nsDownloadScanner, which referred "browser.download.manager.scanWhenDone" since Firefox 24.
2. Bug 909022 added "browser.download.saveZoneInformation" instead since Firefox 26.
3. Bug 952961 replaced "browser.download.saveZoneInformation" with a Group Policy setting since Firefox 29.
Anyway, "browser.download.manager.scanWhenDone" is gone.