1810748 - Place downloaded DLL files into subfolder within download directory

Status: NEW

(Firefox :: File Handling, defect, P3)

Description

[Chris Martin [:cmartin]]

Bug 1605308 introduced a patch causing any .exe file launched through our "Downloads" menu to inherit the same security permissions as the current firefox.exe process. This was done mainly to prevent DLL files the user may have been tricked into downloading from being unintentionally loaded.

Unfortunately, this approach seems to have a few shortcomings:

1. Some applications would not be compatible running under the same permissions that firefox.exe runs under
2. Some applications explicitly require the ability to load custom versions of system DLLs
3. Users generally would expect that launching a program from our "Downloads" dialog would have the same behavior as-if they had navigated there in Explorer and launched it themselves (I know I've always assumed this...)
4. Users are not protected by this approach in the last scenario

We ran into a program that is broken by this in Bug 1802834, where I proposed an alternative -- Let's revert the change in Bug 1605308 and instead store all DLL downloads in a subfolder in the Downloads directory. (Possibly just named "DLLs" for simplicity).

There seems to be agreement in the bug that it might be a good approach, so this bug is to actually track the work for implementation.