1576616 - Should not treat JNLP files as Executables (revert bug 1392955) on ESR-68

Status: RESOLVED FIXED

(Firefox :: File Handling, defect)

Description

[Pieter Breugelmans]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

The fix introduced by bug 1392955 (CVE-2019-11696) seems to add any file with a .jnlp extension to a larger list of files Firefox treats as an executable. This results in a default behavior to save and launch the .jnlp files from the operating system (on Windows). If an end user sets up a Firefox option, they are allowed to launch a .jnlp file from the browser, but they still get a scary warning message every single time they try to launch a file with a .jnlp extension.

A file with a .jnlp extension is merely an XML document that describes a Java application (https://docs.oracle.com/javase/8/docs/technotes/guides/javaws/developersguide/syntax.html). It is not an "executable". We think treating .jnlp files as an executable is an oversight. Java product management has explained the layers of security checks performed by the Java platform itself, before allowing any code referenced in a .jnlp file to actually run, in the following comment in the original CVE:

https://bugzilla.mozilla.org/show_bug.cgi?id=1392955#c16

They have also highlighted the comparison between Microsoft Word documents and .jnlp files.

We are filing this issue so files with .jnlp extensions are treated as they always were, i.e. reverted back to the prior behavior.

Comment 1

[:Gijs (out for now; he/him)]

Bugs can be reopened; I'm duping this back to bug 1392955, no point splitting the conversation. We're considering options, I'll respond in the other bug once we reach a conclusion.

Comment 2

[:Gijs (out for now; he/him)]

We will remove JNLP from the list on esr68. We'll update the other bug with more details.

Comment 3

[:Gijs (out for now; he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b53e0322cff38a7f00e2305b36e78ea47d82f6b

Comment 4

[:Gijs (out for now; he/him)]

Attachment: Bug 1576616 - remove JNLP as an executable extension on esr68, r?dveditz,a=?

Comment 5

[:Gijs (out for now; he/him)]

(In reply to :Gijs (he/him) from comment #3)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b53e0322cff38a7f00e2305b36e78ea47d82f6b

Sigh. https://treeherder.mozilla.org/#/jobs?repo=try&revision=a2a117b4802f86d06201b434ce9026805fb31e58

Comment 6

[:Gijs (out for now; he/him)]

Comment on attachment 9088258 [details]
Bug 1576616 - remove JNLP as an executable extension on esr68, r?dveditz,a=?

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: We broke enterprise use of JNLP
• User impact if declined: Bad experience using JNLP, users forced to migrate to other browsers
• Fix Landed on Version: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): We're just removing jnlp from the list of objectionable extensions. This brings windows in line with mac/linux and other browsers (sort of) in terms of warnings wrt JNLP files.

Note that we do not currently plan to land this change on trunk/nightly, nor therefore non-esr 68/69 release. I think Dan will post a more elaborate comment on the original bug with rationale. We're hoping to make more significant changes to our executable handling in the near future, but that won't be possible on ESR, so this is our only option to unbreak enterprises who rely on this for productivity.

• String or UUID changes made by this patch: nope

Comment 7

[:Gijs (out for now; he/him)]

Ryan, given this bug isn't fixed on any other branches, unsure if this gets flagged up on your approval queries, so pinging you directly - I think you and Dan already discussed this bug.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

I suggested to Dan that we take this as a ride-along to whatever ESR68 build we create next (noting that we already built the 68.1esr RC today) but ultimately it's Julien's call as the owner of this release. Given that we aren't force-migrating users from ESR60 to ESR68 until 68.2esr in October, I'm not sure this warrants respinning the 68.1esr builds on its own.

Comment 9

[Daniel Veditz [:dveditz]]

This bug (a simple back-out) has been made specific to ESR-68. For discussion going forward please see bug 1576762

Comment 10

[Julien Cristau [:jcristau]]

Comment on attachment 9088258 [details]
Bug 1576616 - remove JNLP as an executable extension on esr68, r?dveditz,a=?

approved for 68.2

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-esr68/rev/0be4f1622b51