1146911 - Malicious files are successfully downloaded through a download area using SSL enabled protocol.

Status: NEW

(Firefox :: Downloads Panel, defect)

Description

[Catalin Varga [QA][:VarCat]]

FF 38
Build id: 20150323004010
OS: Win 7 x64, Ubuntu 14.04 x86, Mac Os X 10.7.5

STR:

1. Go to http://www.eicar.org/85-0-Download.html
2. Download eicar.com from "Download area using the secure, SSL enabled protocol https" section (eg: https://secure.eicar.org/eicar.com)

Issue:
The file is successfully downloaded without being blocked.

Comment 1

[Jared Wein [:jaws] (please needinfo? me)]

Monica, do you know if the integrity check is bypassed for SSL downloads?

Comment 2

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Screen Shot 2015-03-24 at 9.55.43 AM.png

Comment 3

[[:mmc] Monica Chew (no longer reading bugmail)]

No, it is not skipped for SSL downloads. Francois is asking Google to put that download on their blocklist. Note that Chrome seems to be showing the POTENTIALLY_UNWANTED warning which we don't yet implement, but could now that the quarantine is implemented (see https://bugzilla.mozilla.org/show_bug.cgi?id=1019933).

Comment 4

[François Marier [:francois]]

Also related is that we don't currently do remote metadata lookups for Mac and Linux: https://bugzilla.mozilla.org/show_bug.cgi?id=1111741

Comment 5

[[:mmc] Monica Chew (no longer reading bugmail)]

True, seems like comment 0 tried it out on Windows though.