1306351 - Add a way to mark downloads as started by the user

Status: NEW

(Firefox :: File Handling, defect, P3)

Description

[:Paolo Amadini]

We should add a way to detect if a download was triggered as a result of a top-level load triggered in turn by user interaction. We'll use this for the protection from sites that try to download multiple files automatically. We may need to add platform support in the form of load flags if none is present already.

Comment 1

[William Hsu [:whsu]]

Add to product backlog.

Comment 2

[Johann Hofmann [:johannh]]

I wonder if we could hook into the "temporary permissions" mechanism for this, which does kind of the same thing already. Temporary permissions are cleared until the user navigates away from the page or reloads it, which is kind of what we want for this, too (and it might be even more sensible to apply download protection to the entire tab instead of origin to protect against a.example.com, b.example.com type redirection attacks).

https://searchfox.org/mozilla-central/search?q=cleartemporarypermissions&case=false&regexp=false&path=

That would require no load flag.

Comment 3

[Johann Hofmann [:johannh]]

(In reply to Johann Hofmann [:johannh] from comment #2)
> cleared until the user navigates away from the page or reloads it, which is

Meant to say "cleared when the user navigates away..."