1759670 - When set to "always ask", Firefox is saving .part files into the directory of prior downloads instead of a temp directory

Status: RESOLVED INCOMPLETE

(Firefox :: Downloads Panel, defect)

Description

[Frederik Braun [:freddy]]

Hi,

this was sent to us via email to security@, I'll quote verbatim:

Say you have two folders, Alpha and Beta.

Set firefox to ask the download location every time
save a file to Alpha
Save another download to Beta
the partial download ".part" file will be stored in Alpha before being
moved to Beta

There's a microscopic chance this has security implications so I wanted
to disclose it in private.

I noticed it because Dropbox kept bugging me about part files, so in my
case, Dropbox was getting files it wasn't supposed to be getting.
Privacy implications for me, but not part of the core Firefox security
model.

Windows 10
FF 98.0 (64-bit)

I suppose in lack of a clear direction where to store the ".part" file, choosing a Temporary Directory would be more useful than picking the last directory, but maybe this is working as intended?

Comment 1

[:Gijs (he/him)]

I don't think we use the "last" directory, we should be using the default download directory (which is user-controlled and user-specific). Are you seeing something else?

Comment 2

[Frederik Braun [:freddy]]

I didn't reproduce but have sent email to the original reporter so he can respond directly.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mak, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[:Gijs (he/him)]

Without more info, I think there isn't much we can do here.