1808010 - Longer Title Name - Download Crash

Status: RESOLVED INCOMPLETE

(Toolkit :: Downloads API, defect)

Description

[Ameen Basha M K]

Attachment: attack.html

Hi Team. While testing Mozilla Firefox Download Feature on Windows platform Found a wierd phase in which the same is not happing in any other browsers (Chrome, edge) etc

While Saving a Webpage the title will be used as a default suggested name for save, While saving them if the File name is long than the windows suggested 256 the download is crashed and Failed. (This could be further used in some Browser Crash or Memory Corruption)

But the same thing is not possible in Chrome and Edge(These case was handled). so this is not specific to Chromium

I have attached the sample Html used for the POC

Once download failed the windows explorer was also become not responding for some time

Steps to reproduce

1. Open the POC Html File
2. Save the page by pressing Ctrl + S
3. Save with suggested Name.

Now Download will fail and Windows Explorer will become slower

FYI: Tested in Latest version of firefox, Windows 11

Comment 1

[Ameen Basha M K]

Attachment: Firefox download Failed

Comment 2

[Ameen Basha M K]

Attachment: Chrome Download Success

Comment 3

[:Gijs (out until Jan 5th; he/him)]

(In reply to Ameen from comment #0)

While Saving a Webpage the title will be used as a default suggested name for save, While saving them if the File name is long than the windows suggested 256 the download is crashed and Failed.

What does "crashed and failed" mean here? Does the browser process actually crash? Your screenshot suggests not; it is just the download that fails, right?

Comment 4

[:Gijs (out until Jan 5th; he/him)]

(In reply to Ameen from comment #0)

Created attachment 9310224 [details]
attack.html

Steps to reproduce

1. Open the POC Html File
2. Save the page by pressing Ctrl + S
3. Save with suggested Name.

FWIW, if I try these steps with the attached file the suggested file is "attack.html", not a very long string, and as a result there is no issue. Tested on 109 beta. It would be useful if you could clarify exactly what version you're using, and/or if perhaps bugzilla is breaking this testcase, in which case perhaps you can link to a web-based page that reproduces the issue?

Comment 5

[Ameen Basha M K]

I have installed the latest version on 2 weeks back in windows

FYI: if the POC is not working for you, you can replace the title tag with some large text

Comment 6

[:Gijs (out until Jan 5th; he/him)]

(In reply to Ameen from comment #5)

I have installed the latest version on 2 weeks back in windows

FYI: if the POC is not working for you, you can replace the title tag with some large text

You haven't really answered either of my questions. I'll restate them a bit for clarity:

(In reply to :Gijs (he/him) from comment #3)

What does "crashed and failed" mean here? Does the browser process actually crash? Your screenshot suggests not; it is just the download that fails, right?

(In reply to :Gijs (he/him) from comment #4)

FWIW, if I try these steps with the attached file the suggested file is "attack.html", not a very long string, and as a result there is no issue. Tested on 109 beta. It would be useful if you could clarify exactly what version you're using, and/or if perhaps bugzilla is breaking this testcase by providing a Content-Disposition filename header, in which case perhaps you can link to a web-based page that reproduces the issue?

Comment 7

[:Gijs (out until Jan 5th; he/him)]

It's been 1 month since the needinfo request, so tentatively closing this out. We can reopen if clearer steps to reproduce the issue are made available.