Open Bug 1750979 Opened 2 years ago Updated 2 years ago

Save link as doesn't respect the extension (for wsf, asp and lnk files, if there is no server-sent mimetype or it does not match)

Categories

(Firefox :: Downloads Panel, defect, P3)

defect

Tracking

()

Tracking Status
firefox-esr91 --- affected
firefox96 --- affected
firefox97 --- affected
firefox98 --- affected

People

(Reporter: aflorinescu, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

As part of testing for the Downloads panel improvements a thorough extension testing has been performed with additional accent on save as link: complete list of extensions tested here: testrail_link

The following types were found to be saved as with double extension:

A. Windows 10 (testing complete)

.wsf - saves link as sample.wsf.xml (http://file.fyicenter.com/114_WSF-File_Extension_for_Windows_Script_Files.html)
.asp - saves link as sample.asp.htm (href local file to https://www.w3schools.com/asp/asp_introduction.asp)

B. MAC (testing complete)

.asp - saves link as sample.asp.htm (href local file to https://www.w3schools.com/asp/asp_introduction.asp)

C. Ubuntu (testing complete)

.asp - saves link as sample.asp.htm (href local file to https://www.w3schools.com/asp/asp_introduction.asp)

Regression Range:

This behavior doesn't seem to be a recent regression and is reproducible regardless of the value for browser.download.improvements_to_download_panel

e.g. Steps:
  1. Access http://file.fyicenter.com/114_WSF-File_Extension_for_Windows_Script_Files.html
  2. find the .wsf sample
  3. Right click on the link, save link as
  4. Ensure that the Save modal presents the extension as expected.
  5. Check the saved/downloaded file.
Attached image example_asp.jpg
Severity: -- → S4

(In reply to Adrian Florinescu [:aflorinescu] from comment #0)

e.g. Steps:
  1. Access http://file.fyicenter.com/114_WSF-File_Extension_for_Windows_Script_Files.html
  2. find the .wsf sample
  3. Right click on the link, save link as

At least in this case, the server sends no mimetype at all. We end up guessing the mimetype is xml, and then (apparently?) enforcing that on Windows. The extension is correct on macOS for me, so tentatively morphing the bug accordingly. Feel free to update the bug if there's cases I'm missing.

What's happening for the lnk and asp files I'm not sure without direct links - I didn't see any in testrail.

Priority: -- → P3
Summary: Save link as doesn't respect the extension (for given extensions) → Save link as doesn't respect the extension (for wsf, asp and lnk files, if there is no server-sent mimetype or it does not match)

I see a link in Testrail to the W3Schools ASP examples, but those seem to be getting served as the text/html MIME type, so we're using what the server tells us there.

(In reply to Molly Howell (she/her) [:mhowell] from comment #3)

I see a link in Testrail to the W3Schools ASP examples, but those seem to be getting served as the text/html MIME type, so we're using what the server tells us there.

Think this might be the case:

https://github.com/strayge/pylnk/raw/master/tests/examples/desktop.lnk - saves file.lnk correctly
https://github.com/strayge/pylnk/blob/master/tests/examples/desktop.lnk - saves file.lnk.html

(due to above, remove lnk from the list)

See Also: → CVE-2022-36314
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: