1470295 - Allow Save-as links to FTP files on HTTP pages.

Status: VERIFIED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Tom S [:evilpie]]

See bug 1469536 comment 19.

Comment 1

[Tom S [:evilpie]]

Attachment: Allow save-as download of FTP files on HTTP pages. r?

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8986918 [details] [diff] [review]
Allow save-as download of FTP files on HTTP pages. r?

Review of attachment 8986918 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks, r=me

::: dom/security/nsContentSecurityManager.cpp
@@ +182,5 @@
>  
> +  // Allow save-as download of FTP files on HTTP pages.
> +  if (type == nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD) {
> +    return NS_OK;
> +  }

Maybe bundle that check with the TYPE_DOC check, something like:

// Allow top-level FTP documents and
// save-as download of FTP files on HTTP pages.
if (type == nsIContentPolicy::TYPE_DOCUMENT ||
    type == nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD) {
  return NS_OK;
}

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/54b5db87eb7e
Allow save-as download of FTP files on HTTP pages. r=ckerschb

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/54b5db87eb7e

Comment 5

[Tom S [:evilpie]]

Attachment: Patch to uplift

Approval Request Comment
[Feature/Bug causing the regression]: bug bug 1404744
[User impact if declined]: From an HTML page, right clicking on a FTP link 'Save Link as' doesn't work
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: 1) Create HTML page with a link to an FTP file
2) Right click link and click 'Save Link As...'
3) File should download
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: Allows some limited old behavior
[String changes made/needed]: None

Comment 6

[roxleitan]

I could not reproduce the issue using an HTML page with an FTP link created by me or using the link provided in bug 1469536 comment 19 with Nightly 62.0a1 (2018-06-21) or using the latest Nightly 62.0a1(2018-06-26).

Xu Zhen, could you please confirm the fix on the latest Nightly?

Comment 7

[Xu Zhen]

Tested with 62.0b3 and 63.0a1(209180627), the save-as function was working.
And I found another regression: visiting undisplayable file on FTP server makes Firefox hang.
Click ftp://ftp.mirror.nl/pub/Museum/atari/files/stnet110.tos , Firefox 62b/63a will hang and consume 100% CPU. Haven't tested with 61.

Comment 8

[roxleitan]

Based on comment 7 I'm marking this bug as Verified fixed.

Xu Zhen, thanks for the report, I can confirm the issue described in comment 7 and I will file another bug for this.

Comment 9

[Tom S [:evilpie]]

(In reply to [e-mail] from comment #8)
> Based on comment 7 I'm marking this bug as Verified fixed.
> 
> Xu Zhen, thanks for the report, I can confirm the issue described in comment
> 7 and I will file another bug for this.

Which bug number is this? This is quite a serious issue.

Comment 10

[Darkspirit]

(In reply to Tom Schuster [:evilpie] from comment #9)
> Which bug number is this? This is quite a serious issue.

bug 1471594 / bug 1467102

Comment 11

[Tom S [:evilpie]]

Thank you Jan!

Did we decide not to uplift this bug?

Comment 12

[Darkspirit]

[Tracking Requested - why for this release]:
See comment 5 + comment 11.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8987341 [details] [diff] [review]
Patch to uplift

Approved for 61.0.1.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/2f2e89cae162

Comment 15

[Ciprian Georgiu, Desktop QA]

Attachment: testcase.html

Comment 16

[Ciprian Georgiu, Desktop QA]

I was able to reproduce this bug using the attached testcase on an affected Nightly build 62.0a1 (2018-06-21).

I can confirm that the bug is no longer reproducible on 61.0.1 (20180704003137) under the following OSes: Windows 10 x64, macOS 10.12 and Ubuntu 16.04 x64.