Open Bug 1651800 Opened 9 months ago Updated 8 months ago

Space sequences in download names are replaced with single spaces

Categories

(Firefox :: File Handling, defect, P3)

78 Branch
defect

Tracking

()

Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- wontfix
firefox78 --- wontfix
firefox79 --- wontfix
firefox80 --- fix-optional

People

(Reporter: garoz+bugzilla, Unassigned)

References

(Regression)

Details

(Keywords: regression)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

  1. Go to any site that lets you download files after clicking links (e.g. https://tsundere.services/)
  2. Click any link for a file / chapter
  3. When Firefox prompts for the filename to save to, enter one with two or more consecutive spaces like "1 2 3 4 5 X.zip"

Actual results:

The file is saved, but the name of the file isn't the one entered by the user.
Namely, any consecutive sequence of 2+ spaces is replaced by a single space. In the example above, file was saved as "1 2 3 4 5 X.zip"

Expected results:

File should have been saved with the name entered.

BTW this doesn't happen when using the "save image as" functionality.
Also, this is happening since at least two weeks, so it applies to version 77 as well.

Gah, the file name was mangled in my bug report... Now retrying with non-breaking spaces
The first file was meant to be "1 2  3   4    5     X.zip"

Hi, garoz+bugzilla!

Thanks for your contribution!

I couldn't reproduce the described behavior in:

Windos 10 Pro 64 bits
Firefox 78.0
Firefox 78.0.2
Nightly 80.0a1 (2020-07-08) (64-bit)

The name of the file is properly saved when changed.

Please let us know if this issue is reproduced in the latest Nightly edition. You can download it from here: https://nightly.mozilla.org/

If you still have the issue please create a new profile, you have the steps here: https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles?redirectlocale=en-US&redirectslug=Managing-profiles#w_starting-the-profile-manager
support.mozilla.orgsupport.mozilla.org

Once you have all this information, please let us know so we can continue investigating.

Regards,

Flags: needinfo?(garoz+bugzilla)

Hi Sebastian, thanks for your attention.
I've tried again with the latest nightly and its default empty profile and I'm afraid the results are the same...

Out of the box the issue doesn't manifest; downloads are saved in the Downloads folder with the name set by the originating site (and the problem cannot be reproduced, because AFAIK no site uses double/triple spaces in the downloads it serves).

But when I activate the option "Always ask you where to save files" and try downloading the Firefox installer and giving it a name like "Firefox Installer      en-US.exe" (it's meant to have six spaces between "Installer" and "en-US", in case the comment system decides - again - that it knows better than me), the file gets saved as "Firefox Installer en-US.exe", same as it did on my regular profile on the Desktop channel.

I've gathered screenshots of the steps and saved them on imgur at the link https://imgur.com/a/0bfJg6n .

Hope this clarifies the problem I'm seeing. If there's some other information you need to resolve the issue, I'm here.
Cheers,
Garoz

Flags: needinfo?(garoz+bugzilla)

Hi Aleph1!

Thank you for taking the time to add more details to the report!

You were right, I could reproduce the issue and like you mentioned multiple spaces are replaced with single spaces. I will be adding product and component to this so devs can take a look and research.

Regards,

Status: UNCONFIRMED → NEW
Component: Untriaged → File Handling
Ever confirmed: true

The downloads code sanitizes file names compressing spaces, we didn't find compelling use-cases to support multiple consecutive spaces, and considered the web pages (html) do the same, it seems counter productive to not do so.

Could you please tell us more about your use-case and why multiple spaces are critical (and not repleaceable with some other char).

Flags: needinfo?(garoz+bugzilla)
Keywords: regression
Regressed by: 1598216

Sorry, had to think hard how to phrase the reply diplomatically because the needinfo reads a lot like "you're saving your files wrong" :)
IMO I shouldn't have to provide a justification for how I choose to arrange files on my own computer, just saying...

That said, my use case is to force a specific ordering on disk for the files I download, without having to add extraneous printable characters (see also footnote 1).

I thought the most compelling reason for not modifying valid file names (especially silently, and after asking where to save) is "because that's the user choice". Seriously, there isn't any other program that pops up a save dialog and then saves silently to a different filename than what it's told. If for some reason they can't save at the location provided by the user (e.g. because of lack of access rights, or because the filesystem doesn't support some characters, or the total path length exceeds what it can handle) at most they pop up a notification offering the chance to correct; they surely don't go ahead and save to a different filename.
By all means go ahead and sanitize download names when there are security implications, but if the save position is otherwise valid it shouldn't be the browser's business to do different from what it's told to.

BTW the browser shouldn't replace runs of spaces even when it's configured to not ask where to save IMO. Let's suppose someone uploads two files e.g. to Dropbox, named "File A.txt" and "File  A.txt". When then downloaded with Firefox, those two files become "File A.txt" and "File A (2).txt" ... Don't think that's the behavior a user would reasonably expect from their browser.

Sorry for sounding ranty, but I remember when browsers were called "user agents" and that informed my expectations that they should act on my behalf (and not in spite of me).

Cheers, Aleph1
   

footnote 1: tried using non-breaking spaces (alt+0160 on Windows) and they're collapsed to a single one just like normal spaces. Web pages don't replace runs of them, as you surely know.

Flags: needinfo?(garoz+bugzilla)

I'm sorry, it was not my intention to say whether your use case is right or wrong, I just meant there are so many use-cases that we may have to make a choice to what we want and what not.

(In reply to Aleph1 from comment #6)

Seriously, there isn't any other program that pops up a save dialog and then saves silently to a different filename than what it's told.

I don't think that we show a name and then save to another one, apart from the string you are typing of course, we can't change that while you're typing. Please let me know if somewhere (a download dialog or panel) we show the unstripped string.

By all means go ahead and sanitize download names when there are security implications, but if the save position is otherwise valid it shouldn't be the browser's business to do different from what it's told to.

Well, there is some security implications if you can hide the file extension with a large amount of spaces, I just tried and it's totally doable on Windows.
But there are also usability problems when the file name can easily be wrongly presented to the user in html, because naturally it compresses spaces.
Additionally for most users it is really hard to distinguish from 2 spaces on, is it 4 or 5? is that meaning information at that point? We should not be optimizing for edge-cases in general.

BTW the browser shouldn't replace runs of spaces even when it's configured to not ask where to save IMO. Let's suppose someone uploads two files e.g. to Dropbox, named "File A.txt" and "File  A.txt". When then downloaded with Firefox, those two files become "File A.txt" and "File A (2).txt" ... Don't think that's the behavior a user would reasonably expect from their browser.

Yes, I'd expect that. The space is not adding useful information, and may well hide a bug that the uploader didn't notice.

footnote 1: tried using non-breaking spaces (alt+0160 on Windows) and they're collapsed to a single one just like normal spaces. Web pages don't replace runs of them, as you surely know.

True, but visually for a user it doesn't make a difference, it may still be confusing.

Don't want to sound as a broken disc, but with all other programs, when you enter a valid filename to save to, that's the name the file gets saved to; no ifs and no buts. I've tried on Chrome and Edge, and they work as intended (and as Firefox used to until a few weeks ago).

Even Firefox itself, when you do "Save image as" or "Save page as" and you enter a filename with multiple spaces, it obliges without complaints (and moreover, those files show up in Downloads). I don't see why only downloads fired from web pages should be treated as an exception.
I cannot put it simpler than that..

What I'm doing may be an edge case, but everything that's done on computers is someone's edge case. It's not like I was asking for emojis in filenames... (urk, tried now, and Firefox totally does save filenames with emojis in them 🤣)

By the way I get that some malicious entities might try to obfuscate the real extension by padding the filename with spaces, but that could be obviated by less drastic means, like collapsing just overlong sequences (like 20+ spaces)

It's possible we sanitize too late in the process, we should be sanitizing the name before showing the dialog and then respect user's spacing after it. Though, one of the reasons for whitespace compression later is that we replace some invalid characters with spaces, but we don't want that to introduce runs of spaces, so for simplicity we just compress after the replacement.
We should check if we can find an easy way to still compress whitespaces when we actually introduced them, without touching the user provided ones.

Severity: -- → S3
Priority: -- → P3
See Also: → 1657275
See Also: 1657275
Duplicate of this bug: 1657275
You need to log in before you can comment on or make changes to this bug.