Closed Bug 1274959 Opened 8 years ago Closed 8 years ago

Do we want to support link files in HTMLInputElement - filePicker/directory upload API/blink fileSystem API?

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox50 --- fixed

People

(Reporter: baku, Assigned: baku)

References

Details

(Whiteboard: btpp-active)

Attachments

(3 files)

      No description provided.
Blocks: 1265767, 1188880
I believe we do want to support them. We support them currently when picking files and IIRC other browsers support them too (at least on linux).
I don't recall where and why we added the check to not support links in new file picker stuff, and that check has been then copied elsewhere.
You mean the filtering at:

https://mxr.mozilla.org/mozilla-central/source/dom/filesystem/GetDirectoryListingTask.cpp?rev=16663eb3dcfa#369

That's been there since I added the GetDirectoryListingTask task. See the part 2 patch in bug 1177688. There's no reason to exclude links other than the fact that I decided to start conservative and relax restrictions later. If we support links we would need to decide what we do when the links point outside the directory picked by the user, and we should definitely document our rational in code comments.
The reason why I excluded them, is because with getFiles, recursively, we must be smart enough to avoid loops. I'll take this bug.
Whiteboard: btpp-active
I would like to write a test but it seems that our nsIFile doesn't support the creation of symlinks.
Attachment #8773718 - Flags: review?(bugs)
Attachment #8773718 - Flags: review?(bugs) → review+
Comment on attachment 8773719 [details] [diff] [review]
part 2 - Unify GetFilesHelper and GetFilesTaskParent

> ///////////////////////////////////////////////////////////////////////////////
> // GetFilesHelper Base class
> 
>+
> already_AddRefed<GetFilesHelper>
extra newline
Attachment #8773719 - Flags: review?(bugs) → review+
Comment on attachment 8773734 [details] [diff] [review]
part 3 - no loops with symlink in Directory.getFiles()

>+  if (!isLink) {
>+    nsAutoString path16;
>+    rv = aDir->GetPath(path16);
>+    if (NS_WARN_IF(NS_FAILED(rv))) {
>+      return rv;
>+    }
>+
>+    path = NS_ConvertUTF16toUTF8(path16);
>+  } else {
>+    rv = aDir->GetNativeTarget(path);
>+    if (NS_WARN_IF(NS_FAILED(rv))) {
>+      return rv;
>+    }
>+  }
>+
>+  if (NS_WARN_IF(!mExploredSymLinks.AppendElement(path, fallible))) {
So we append all directories to mExploredSymLinks, not only links. So change the name
mExploredSymLinks to mmExploredDirectories or some such?


>+  for (uint32_t i = 0; i < mExploredSymLinks.Length(); ++i) {
>+    if (mExploredSymLinks[i].Equals(targetPath)) {
>+      return false;
>+    }
>+  }
This is probably fine, though hashtable might be quite nice too. Up to you.
Hashtable would probably make this a bit simpler.
Attachment #8773734 - Flags: review?(bugs) → review+
Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3f1e16d3bfb2
Support symlinks in Directory API - part 1 - Directory.getFilesAndDirectories, r=smaug
https://hg.mozilla.org/integration/mozilla-inbound/rev/c2462f5e5e38
Support symlinks in Directory API - part 2 - Unify GetFilesHelper and GetFilesTaskParent, r=smaug
https://hg.mozilla.org/integration/mozilla-inbound/rev/e28c3a696524
Support symlinks in Directory API - part 3 - no loops with symlink in Directory.getFiles(), r=smaug
Component: DOM → DOM: Core & HTML
See Also: → CVE-2023-37206
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: