1682096 - Allowing to download PDF cross-origin - Race condition

Status: RESOLVED INVALID

(Fenix :: General, defect)

Description

[Kirtikumar Anandrao Ramchandani]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36/8vfJ8dsw-50

Steps to reproduce:

1. Visit https://kirtikumarar.com/ff_pdf.html
2. Copy the pdf link and paste in the field
3. Click the download

Actual results:

It downloaded a document from cross-origin

Expected results:

It shouldn't download the document from the cross-origin

Comment 1

[Kirtikumar Anandrao Ramchandani]

The test case on the site is taken from:- https://bugzilla.mozilla.org/show_bug.cgi?id=1449898 (Credits:- Wladimir Palant)

Comment 2

[Daniel Veditz [:dveditz]]

When I try this I get a Denial of Service contantly trying to download the PDF file, but they copies are going to MY PHONE and are not readable by your attack page. The problem with the other bug was not that you could download the PDF (that's fine!) but that the attacker's page could read some of it.

Am I doing your testcase wrong?

Comment 3

[Daniel Veditz [:dveditz]]

The major difference is that Firefox on desktop has a built-in PDF viewer and that's where the bug was. On Android we just hand the PDF off to your phone to find an appropriate app, so it can't communicate back.

Comment 4

[Kirtikumar Anandrao Ramchandani]

Thanks for a detailed explanation, makes sense. And no sir, you aren't doing it wrong. The PDF should be downloaded back-to-back in a loop from cross-origin. But Chrome and its other variants aren't downloading document from cross-origin in Android. What can be the reason they blocked downloading the document from cross-origin like they do in desktop? No, for me I wasn't getting a DoS because I haven't given permission to for downloading yet. Maybe it can lead to DoS due to a big loop but still then the point is how chrome is protecting its user from this type of race conditions and also from downloading the document from cross-origin? Correct me if I'm wrong.

Comment 5

[Kirtikumar Anandrao Ramchandani]

Tried on:
Google Chrome 87.0.4280.66 (Official Build) (32-bit)
OS Android 9; Redmi Note 5 Pro Build/PKQ1.180904.001

And Firefox: 84.1.0 (Build #2015780659)

Comment 6

[Rob Wu [:robwu]]

A cross-origin download is a legitimate feature. The original bug was not about downloading but reading data across origins using a vulnerability in the PDF viewer. That does not apply here, as Dan has explained.

The lot of dialogs will be addressed as part of bug 1554980 (https://github.com/mozilla-mobile/fenix/issues/16247).