1612039 - g-fox.cn存在 .DS_Store文件导致信息泄露

Status: RESOLVED FIXED

(Mozilla China :: General, defect)

Description

[Zhou Cheng]

Attachment: 下载的文件

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36

Steps to reproduce:

我发现在g-fox.cn中存在.DS_Store文件。
http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store

Actual results:

使用ds_store_exp.py解析.DS_Store文件并递归下载文件。
C:\Users\admin\Desktop\ds_store_exp-master>python2 ds_store_exp.py http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store
[200] http://g-fox.cn/chinaedition/addons/cpmanager/.DS_Store
[200] http://g-fox.cn/chinaedition/addons/cpmanager/update.rdf
[!] [Errno 2] No such file or directory: u'g-fox.cn/chinaedition/addons/cpmanager/update.rdf/.DS_Store'
[200] http://g-fox.cn/chinaedition/addons/cpmanager/cpmanager-1.2.12.xpi

Expected results:

删除 .DS_Store文件

Comment 1

[jiechen xia]

.DS_Store文件已删除。

Comment 2

[Daniel Veditz [:dveditz]]

reporter requested a bounty in mail to the security alias. I don't believe the Mozilla China sites are covered (g-fox.cn doesn't appear on the "eligible" list) but flagging for review just in case.

Comment 3

[Daniel Veditz [:dveditz]]

The bounty committee determined that this does not meet the criteria for a bug bounty.