1692993 - When downloading a file considered unsecure and allow the download, Firefox puts a 0 octet file in the Download dir

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect, P1)

Description

[Alex ARNAUD]

Hello,

I'm on Debian GNU/Linux 10 with Firefox Nightly.

Steps to reproduce:

1. Open this page for example: https://wiki.geogebra.org/en/Reference:GeoGebra_Installation#GeoGebra_Classic_6
2. Click on the link to download the Linux (deb) version of GeoGebra.
3. Firefox finds it as unsecure, allow the download anyway.
4. Try to right-click then choose open the directory where the file has been downloaded.
5. You're going to /tmp/
6. Go on the download folder

Result:
In the download folder, a file with the right name exists but with 0 octet.

Expected result:
The file should be placed in the download folder.

Thanks in advance.

Comment 1

[Dragana Damjanovic [:dragana]]

Does this happens with older versions of Nightly?

Comment 2

[Alex ARNAUD]

(In reply to Dragana Damjanovic [:dragana] from comment #1)

Does this happens with older versions of Nightly?

In version of September 2020, it was merely impossible to download the mentioned file with Firefox because the download was completely unauthorized. I think the feature to allow downloading considered insecure files never download the file in the right folder, at least under GNU/Linux.
(I don't think I could perform mozgression on this bug.)

Comment 3

[Valentin Gosu [:valentin] (he/him) {{ PTO until Nov 5 }}]

Mozregression points to bug 1676221

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1676221

Comment 5

[Julien Cristau [:jcristau]]

dom.block_download_insecure is nightly only

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Julian, any chance you could take a look at this one as well?

Comment 7

[Masatoshi Kimura [:emk]]

Dupe of bug 1686756?

Comment 8

[Daniel Veditz [:dveditz]]

(In reply to Masatoshi Kimura [:emk] from comment #7)

Dupe of bug 1686756?

That bug is "https-only" mode. similar, but not quite a dupe.

Comment 9

[Sebastian Streich [:sstreich]]

Hi! -From the time this was reported, we changed the way we choose the download location && how we handle the file cleanup.
I can't reproduce this with today nightly on ubuntu. Can you maybe recheck if this problem still happens for you? :)

Comment 10

[Alex ARNAUD]

(In reply to Sebastian Streich [:sstreich] from comment #9)

Hi! -From the time this was reported, we changed the way we choose the download location && how we handle the file cleanup.
I can't reproduce this with today nightly on ubuntu. Can you maybe recheck if this problem still happens for you? :)

I confirm, I no longer reproduce the problem too.

Thanks a lot for fixing it.