1644877 - Mark DER files as executable/dangerous

Status: RESOLVED FIXED

(Firefox :: File Handling, defect, P1)

Description

[Mike Kaply [:mkaply]]

DER files should be on our executable list since CRT files are already there.

Comment 1

[:Gijs (he/him)]

Dimi, should they be checked with appreputation? (see https://searchfox.org/mozilla-central/rev/4bb2401ecbfce89af06fb2b4d0ea3557682bd8ff/toolkit/components/reputationservice/ApplicationReputation.cpp#102-139 )

Comment 2

[Mike Kaply [:mkaply]]

I failed to give background on this. Sorry about that.

In bug 1024871 we made it so that CRT/DER files no longer get added automatically to Firefox, they get downloaded.

The result of that now is that CRT and DER files behave differently from each other (at least on Windows).

CRT files are always forced to download because they are on the sExecutable list.

Because DER files are not on the list, you're offered to execute them via Windows.

Since CRT/DER files both have the same outcome and are the same mime type (application/x-x509-ca-cert), either both should be marked executable or neither should be marked executable.

There shouldn't be a difference between how the two are treated.

Comment 3

[Dimi Lee [:dimi]]

(In reply to :Gijs (he/him) from comment #1)

Dimi, should they be checked with appreputation? (see https://searchfox.org/mozilla-central/rev/4bb2401ecbfce89af06fb2b4d0ea3557682bd8ff/toolkit/components/reputationservice/ApplicationReputation.cpp#102-139 )

Yes, so it should be in sExecutableExts.

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1644877 - mark .der files as executable (just like .crt), r?dimi

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/feadc078cdf3
mark .der files as executable (just like .crt), r=dimi

Comment 6

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/feadc078cdf3