1601614 - Consider deprecating downloads.open()?

Status: RESOLVED WONTFIX

(WebExtensions :: Compatibility, task, P3)

Description

[Tomislav Jovanovic :zombie]

We've heard through the grapevine that Chrome is considering deprecating this and aliasing the method call to downloads.show().

As we've seen this api used to trick users, as well as part of several PoC for sec issues, we might wanna do the same.

Comment 1

[Tomislav Jovanovic :zombie]

Resetting to retriage and possibly include in MV3.

Comment 2

[Rob Wu [:robwu]]

https://sql.telemetry.mozilla.org/queries/62842/source?p_permission=downloads.open

currently lists 8.8k entries (i.e. add-ons that request the downloads.open permission; multiple versions of the same add-on are included in this result).

Comment 3

[Rob Wu [:robwu]]

Here is the (now public) security bug where deprecation of downloads.open was suggested:
https://bugs.chromium.org/p/chromium/issues/detail?id=1029375#c2

The Chrome extensions Tech Lead objected to the deprecation/removal of downloads.open and offered arguments in favor of keeping it: https://bugs.chromium.org/p/chromium/issues/detail?id=1029375#c7

The downloads.open API currently requires user interaction and the downloads.open permission (with a permission warning) in both Firefox and Chrome. This ought to be sufficient to counter abuse.