1448161 - Firefox changes default .txt app from TextEdit to Console (OS X)

Status: RESOLVED WORKSFORME

(Core :: Security: Process Sandboxing, defect, P1)

Description

[u614529]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0.3 Safari/604.5.6

Steps to reproduce:

Firefox 59.0.1 Mac OS X El Capitan 10.11.6

Whenever I open Firefox, it changes my default .txt program from TextEdit to Console. When I change it back via Get Info/Open With/Change All, it remains correct until the next time I open Firefox, at which point the default program is again changed from TextEdit to Console. A link I provide below is another person reporting the same problem via macrumors. That person resolved the issue by changing the security.sandbox.content.level setting from 3 to 2. I will do that once I know what, if anything, lowering the security level exposes me to, since a likely related bug report here (link below) says that change should be used only temporarily.

The bug I'm reporting does seem related to this bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1437281

The other report identical to mine:

https://forums.macrumors.com/threads/something-keeps-changing-my-open-with-defaults.2103071/page-3



Actual results:

Firefox changes default app for .txt files from TextEdit to Console.


Expected results:

Firefox should not change a Mac's program that opens a particular file extension.

Comment 1

[Adrian Florinescu [:aflorinescu]]

Thanks [e-mail] for the report. In my oppinion, this bug is duplicated after bug 1437281.
Could you please confirm that setting security.sandbox.content.level to 2 solves the problem?

In regards to the differences between lvl 2 and lvl 3 sandboxes, although a bit technical see: https://wiki.mozilla.org/Security/Sandbox#Content_Levels

Comment 2

[u614529]

When attempting to enter about:config, as you advise, I get an exclamation-point-laden warning from Firefox that I'm about to harm "the security, stability, and performance" of Firefox and "void [my] warranty." I see from your wiki link that the only difference between the two security levels, apparently, is "read access to ~/Library". Please discuss.

Comment 3

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #0)
> Whenever I open Firefox, it changes my default .txt program from TextEdit to
> Console. When I change it back via Get Info/Open With/Change All, it remains
> correct until the next time I open Firefox, at which point the default
> program is again changed from TextEdit to Console. A link I provide below is
> another person reporting the same problem via macrumors. That person
> resolved the issue by changing the security.sandbox.content.level setting
> from 3 to 2.

alanzrx-bug, thanks for reporting this issue. Is just running Firefox and quitting enough to trigger the .txt application changing? I think this is related to bug 1437281, but it's a slightly different problem if just launching the browser and quitting is enough to trigger it.

(In reply to alanzrx-bug from comment #2)
> When attempting to enter about:config, as you advise, I get an
> exclamation-point-laden warning from Firefox that I'm about to harm "the
> security, stability, and performance" of Firefox and "void [my] warranty." I
> see from your wiki link that the only difference between the two security
> levels, apparently, is "read access to ~/Library". Please discuss.

Setting security.sandbox.content.level=2 instead of the default (3), reduces the strength of our web content sandbox. In the event that you visited a site that exploited a bug in Firefox to get control of the web content process, that process would be able to read from more locations on your filesystem with this setting. 
 
This applies to Firefox on Mac only. On Windows and Linux, the value of security.sandbox.content.level controls the sandbox in different ways.

Comment 4

[u614529]

I reduced the strength of your web content sandbox from 3 to 2 via about:config's "security.sandbox.content.level," closed Firefox, reopened Firefox, visited three assumedly safe web sites, closed Firefox, and checked my default program for .txt files. It remained TextEdit and was not changed to Console.

Comment 5

[u614529]

I see I failed to answer one question from Haik. Just launching the browser does not change the .txt default program every single time. And it's not *closing* the browser that triggers the change, but either just launching it or launching it and going to a couple of websites. The first time I noticed this behavior, a few months ago perhaps, it was this: Every time I uploaded a photo to Twitter, Firefox changed my default photo program from Preview to Firefox. More recently, 97% of the time I use Firefox for anything at all, my .txt default application is changed from TextEdit to Console. When I change my default programs back to what they are supposed to be, if I leave Firefox closed and use Safari, all default programs remain as they should. Hope that helps.

Comment 6

[u614529]

An update. Second time this has happened now. Using Firefox just changed my default program for .rtf files from TextEdit to nothing, i.e. no default app.

Comment 7

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #6)
> An update. Second time this has happened now. Using Firefox just changed my
> default program for .rtf files from TextEdit to nothing, i.e. no default app.

Thanks for the info. We're going to get this fixed ASAP. Given what you said in comment 5, I do think this is a duplicate of bug 1437281, but it's difficult to confirm. I'm going to mark this bug as a duplicate of bug 1437281. If it turns out that this problem is still reproducible with the fix for 1437281, this bug can be reopened.

Comment 8

[u614529]

Given the latest information in other, related bug reports, do you still consider this bug duplicative and thus resolved? Since I last posted here, I have noted that the change to my default .txt and .jpg apps only happens when I go to *some* not all websites. Visiting my webmail, a small ISP, does not change my default apps for opening files. Visiting Twitter does.

Comment 9

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #8)
> Given the latest information in other, related bug reports, do you still
> consider this bug duplicative and thus resolved? Since I last posted here, I
> have noted that the change to my default .txt and .jpg apps only happens
> when I go to *some* not all websites. Visiting my webmail, a small ISP, does
> not change my default apps for opening files. Visiting Twitter does.

With bug 1437281, this problem was triggered by dragging. If you're sure that you weren't dragging an image/text/object, then I don't think you were hitting bug 1437281.

Since my last comment, I was made aware of bug 1448374, which is another case of the default application settings getting lost due to the same underlying problem. I'm hoping to get the fix for this integrated into the Nightly release within a few days.

If you're not familiar with the release schedule, when these bugs are fixed, the fixes will first be available in the Nightly release, then Beta, and then the main Firefox release most users are running which can take approximately 3 months.

With these fixes, because this problem is serious, I'm hoping to get the fix out sooner. I hope to uplift them to the Beta release after they've shown to solve the problem on Nightly.  If you're interested in testing a fix, I've posted a link to a Nightly build on bug 1448374 comment 17. I could also provide a Beta or Release build of Firefox to validate the fix solves the problem for you.

Comment 10

[u614529]

I'm sure I'm not dragging anything when this occurs.

Comment 11

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #10)
> I'm sure I'm not dragging anything when this occurs.

OK. I've reopened this bug. I suspect this is a duplicate of bug 1448374, but don't have enough information to definitively say so. If you'd be willing to test it, I'll post a link to a build of Firefox with the fix for bug 1448374. I'll look into other code paths that might be triggering this behavior too. Thanks for the details.

Comment 12

[u614529]

It will be a first for me to install unreleased software to see if it works right, but I'll do it as long as the regular auto-update process will eventually get me back on track with released software. If not, I'll need some additional assistance.

Comment 13

[Haik Aftandilian [:haik]]

OK, I'm going to try to get the two related bugs that have been fixed into the official Beta release of Firefox. Once that has happened I'll update this bug. In trying to track down other places in the code that might trigger the file associations being reset, I've filed bug 1452278 which might be causing the problem in some situations.

Comment 14

[Haik Aftandilian [:haik]]

alanzrx-bug, two bugs that cause the file associations to go awry are now fixed in the Beta release of Firefox. Would you be interested in testing Beta to see if the bug is still reproducible for you? If you'd like to test it, you can download the current Firefox Beta release here https://www.mozilla.org/en-US/firefox/channel/desktop/ It can be installed just like Firefox in /Applications.

Comment 15

[u614529]

Does that create a second installation of Firefox on my system, along with all the related folders and files elsewhere in OS X? Or does it overwrite my current Firefox? If the former, can I trash-can it when I'm done without affecting my current version of Firefox? I've switched to Safari for the duration of this problem, so am also happy to wait for the final release/auto update.

Comment 16

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #15)
> Does that create a second installation of Firefox on my system, along with
> all the related folders and files elsewhere in OS X? Or does it overwrite my
> current Firefox?

It creates a separate installation named FirefoxBeta and doesn't overwrite Firefox. After you download the .dmg file it comes in, you'll have to drag the FirefoxBeta icon from the .dmg folder to /Applications.

All your settings, bookmarks, and history are stored in a profile directory which is stored separately in your home directory. You can create new profiles using about:profiles. Or by launching Firefox from the command line and providing the -P option. Deleting your default profile would delete your bookmarks, history, etc.

> If the former, can I trash-can it when I'm done without
> affecting my current version of Firefox?

Yes, you can delete it at any time without affecting regular Firefox. Just drag FirefoxBeta to the Trash.

> I've switched to Safari for the
> duration of this problem, so am also happy to wait for the final
> release/auto update.

OK. Please feel no obligation to run the test. It would help to know if the problem you're hitting is fixed by one of the recent bug fixes, but it's not essential.

Comment 17

[u614529]

Firefox 61.0.2
Mac OS 10.11.6 El Capitan
15 August 2018

Uploading (not dragging) a photo to Twitter changed the computer's default program for opening a .jpg file from Preview to Firefox.

Uploading another photo to Twitter changed the computer's default program for opening a .txt file from TextEdit to Console.

Comment 18

[u614529]

Firefox 61.0.2
Mac OS 10.11.6 El Capitan
20 August 2018

Uploading (not dragging) a photo to Tumblr just changed the computer's default program for opening a .txt file from Preview to Console, and the computer's default program for opening an .rtf from TextEdit to no program at all.

It would appear that in five months, this bug has not been resolved in any way, as this matches my and others' reports dating back to Firefox 59.0.1.

Do you have an update on this?

Comment 19

[Haik Aftandilian [:haik]]

(In reply to alanzrx-bug from comment #18)
> Firefox 61.0.2
> Mac OS 10.11.6 El Capitan
> 20 August 2018
> 
> Uploading (not dragging) a photo to Tumblr just changed the computer's
> default program for opening a .txt file from Preview to Console, and the
> computer's default program for opening an .rtf from TextEdit to no program
> at all.
> 
> It would appear that in five months, this bug has not been resolved in any
> way, as this matches my and others' reports dating back to Firefox 59.0.1.
> 
> Do you have an update on this?

@alanzrx-bug, I was never able to reproduce this problem, but I'll give it another try on 10.11 today. I did a quick test on 10.13 and could not reproduce the problem. The bug might be addressed by the fix we've been working on in bug 1452278, but I need more testing to confirm that.

Comment 20

[u614529]

I mistyped above. Should say: "changed the computer's default program for opening a .txt file from TEXTEDIT to Console. I'll go look at bug 1452278. The changes I'm still seeing, since Firefox 59, from uploading (not dragging) photos to Twitter and Tumblr, are:

.txt changes from opening with TextEdit to opening with Console
.jpg changes from opening with Preview to opening with Firefox
.rtf changes from opening with TextEdit to having no default program

Doesn't happen if I use Safari.

Firefox 61.0.2, Mac OS 10.11.6, private browsing, uBlock Origin, Privacy Badger, HTTPS Everywhere.

Comment 21

[Haik Aftandilian [:haik]]

I haven't been able to reproduce this on 10.11. I tested uploading a .jpg to Tumblr, but could not see how to upload a .txt file on Twitter. I tested on some other sites.

I'm setting the qawanted keyword to get some help trying to reproduce this. For the QA team, the application registered to open a file can be viewed on Mac by selecting the file in the GUI and using Get Info with Command+i and looking in the "Open with:" section.

I'm going to generate a build with the fix for bug 1452278 (which is in the code review stage now). If you could confirm whether or not that fixes your problem, that would help narrow this down.

Comment 22

[u614529]

No, it's a .jpg to Twitter, not a .txt. See two message above. Thanks.

Comment 23

[Haik Aftandilian [:haik]]

If you would like to test a build with an early fix for bug 1452278, please give this build a try. 

  https://queue.taskcluster.net/v1/task/DAcUsCYTRe6_bOzFnVwgjA/runs/0/artifacts/public/build/target.dmg

When you open the .dmg, the application name will display as Firefox Nightly.

I recommend dragging the application to the Desktop and running it there.

The first time you launch the application, it must be with Right Click->Open. You'll see a warning indicating "Firefox Nightly can't be opened because it is from an unidentified developer" because it is an unofficial build. Click "Open".

It's a good idea to delete the application when you're done with the test so you don't keep using it.

Comment 24

[u614529]

Uploading a photo to Twitter just changed by Mac High Sierra (10.13.6) default program for opening a .jpg from Preview to Grab. 

Firefox 63.0.3. 

Same old same old. :(

I first reported this problem here eight months ago.

Comment 25

[Haik Aftandilian [:haik]]

I suspect this problem was fixed by bug 1452278. I haven't been able to reproduce the bug and we have not had any other reports.