1236381 - Loading unavailable resources via FTP protocol causes annoying warning dialogs

Status: RESOLVED FIXED

(Core Graveyard :: Networking: FTP, defect, P3)

Description

[Xidorn Quan [:xidorn] UTC+10]

Steps to reproduce:
open a HTML page with a lot of unavailable resources via FTP protocol, e.g. ftp://ftp.iingen.unam.mx/Documentacion/Cluster_TONATIUH/Mathematica.v6/v6/web/documents.wolfram.com/mathematica/Built-inFunctions/GraphicsAndSound/ImportAndExport/AdditionalInformation/Export.html (warning: this would display >50 warning dialogs on Firefox)

Expected result:
No warning dialog would prompt

Actual result:
Over 50 warning dialogs are displayed, and there is no way to stop that


(I'm not sure whether it is a Firefox bug or a Core bug, though)

Comment 1

[Xidorn Quan [:xidorn] UTC+10]

Actually it isn't necessary to be an HTML page served via FTP. Any page includes resources via FTP could cause this. And this could actually be an infinite dialog attack against Firefox.

Comment 2

[Xidorn Quan [:xidorn] UTC+10]

Attachment: simple testcase

This is a simple test case which would show 10 warning dialogs on Firefox because of unavailability of the requested resource.

Comment 3

[Xidorn Quan [:xidorn] UTC+10]

Attachment: possible attack

This is a possible infinite dialog attack against Firefox. Warning: open this attachment at your own risk.

Comment 4

[Xidorn Quan [:xidorn] UTC+10]

It doesn't seem to be a Firefox bug, but likely a Necko bug.

Comment 5

[Xidorn Quan [:xidorn] UTC+10]

The prompting happens here: https://dxr.mozilla.org/mozilla-central/rev/29258f59e5456a1a518ccce6b473b50c1173477e/netwerk/protocol/ftp/nsFtpConnectionThread.cpp#1834-1850

It seems necko directly calls UI code to prompt error, which isn't a good practice.

Comment 6

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 7

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 8

[:Gijs (he/him)]

Fixed in bug 1523249.