1235022 - When you use the FTP protocol in browser, you can bypass authentication with Javascript blocking.

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[whitematt3r]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20151216175450

Steps to reproduce:

I visited the FTP server of my website with NoScript enabled.


Actual results:

It didn't ask me to authenticate but instead just took me to the files.


Expected results:

I should have been prompted to authenticate.

Comment 1

[whitematt3r]

Sorry, I meant that this happens when I click on an FTP url, not just typing it out.

Comment 2

[:Gijs (he/him)]

If the FTP server is secured and normally prompts for credentials, the only way this would happen is if the browser knew the credentials and/or was reusing the existing connection to the FTP server, which isn't a bug and has nothing to do with JS or noscript. Firefox cannot magically know the credentials for your FTP server.

I'm going to open this up and mark it as invalid. If I've misunderstood, please be more explicit and try to reproduce in a new Firefox profile ( https://support.mozilla.org/kb/profile-manager-create-and-remove-firefox-profiles ) with and without just noscript installed.