1469083 - When I drag and drop a file from downloaded files list in my firefox browser to my facebook chat (messanger) window the recipient of my message can see url (adress) on my hardrive of this file, showing my personal data like name of the windows user.

Status: RESOLVED DUPLICATE of bug 1422482

(Firefox :: File Handling, defect, P3)

Description

[sosna_123]

Attachment: firefox mistake 1.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20180605171542

Steps to reproduce:

I downloaded a file, a picture for instance. Then I opened "recently downloaded files" tab, drag and dropped it on to my facebook messanger, then send it to my friend. 


Actual results:

My friend was able to see a local path of this file on my hard drive seeing not only my username but also precise placement on my hard drive of this file (user name too). When clicked on file, a friend was able to see my file's url. 


Expected results:

I think that it should just show the picture without my windows user name and local path of this file.

Comment 1

[Stefan [:StefanG_QA]]

Attachment: Fb additional tag comes with the picture.JPG

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 (20180619220118)

Thank you for taking time to report this issue.  I've tested this report on Windows 10 using latest Nightly, Beta and Firefox release build. When I download an image from the Internet (for ex: Panda pic), then from the Recently download files sub-dialog I drag and drop to the facebook chat I can see the following: 

The picture is dropped to the chat window. Along with the picture, I can see an additional tag/item called "www.facebook.com" with a small gray "x" button next to it. If I press the "x" button this tag/item is not sent with the picture.

However on the receiving side, if the user hovers this additional tag/item it can see the absolute path to the sent file.

Comment 2

[Stefan [:StefanG_QA]]

I think the proper component would be Firefox:File Handling. Please change if this is not the right component.

Comment 3

[Stefan [:StefanG_QA]]

Attachment: Fb-additional tag shows sensitive info.JPG