1472631 - Investigate serving the list of executable files remotely or in a hotfixable way

Status: NEW

(Firefox :: File Handling, enhancement, P3)

Description

[:Paolo Amadini]

We have a list of file extensions for which we always warn before executing the downloaded file. This is located in nsLocalFileWin.cpp and nsLocalFileUnix.cpp:

https://dxr.mozilla.org/mozilla-central/rev/23885c14f025b61bb74d85845ac4018f05eb39f8/xpcom/io/nsLocalFileWin.cpp#2888-2965
https://dxr.mozilla.org/mozilla-central/rev/23885c14f025b61bb74d85845ac4018f05eb39f8/xpcom/io/nsLocalFileUnix.cpp#1563-1567

Updating this list now required a full build, but it would be better to have a mechanism for updating it remotely, or provide it through a hotfixable JavaScript module.

On Unix in particular, IsExecutable conflates the check for "file with the executable bit set in the file system" and for "potentially dangerous file type that may trigger code execution in the user profile". These should be separate, and the need for the former is very limited or maybe absent, now that we don't support XUL as a generic platform for developing applications.

Comment 1

[johannes.michler]

For enterprise applications it would be helpful to define trusted domains or at least remove the jnlp from this list to avoid the message confusing users. Or at least to have a remember this page as secure.

Any chance to implement this?