1837830 - Native messaging manifests no longer allow relative paths contaning a `..` component

Status: RESOLVED FIXED

(WebExtensions :: Compatibility, defect, P1)

Description

[Masatoshi Kimura [:emk]]

I do not use this site myself, but according to the announcement, it stopped working since Firefox 114 for Windows:
https://myna.go.jp/html/info/index.html#Login (Japanese)

Comment 1

[Masatoshi Kimura [:emk]]

Regression range:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6d838112fbd5b0dbc4b260e63abea99748e91587&tochange=cff507e2b180811754fda1c13649195b6d438f82

Comment 2

[Masatoshi Kimura [:emk]]

I got this error with broken build:

OperationError: PathUtils.joinRelative: Could not append to path: NS_ERROR_FILE_UNRECOGNIZED_PATH NativeMessaging.jsm:98:33
    startupPromise resource://gre/modules/NativeMessaging.jsm:98

Corresponding source location:
https://searchfox.org/mozilla-central/rev/aa7b0c53b36a74f7b1fc65b9f3c29320ad51cc0a/toolkit/components/extensions/NativeMessaging.sys.mjs#84

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1772932

:barret, since you are the author of the regressor, bug 1772932, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Masatoshi Kimura [:emk]]

PathUtils.joinRelative throws with the following parameters:

PathUtils.joinRelative("C:\\Users\\xxxx\\AppData\\Local\\MPA\\Firefox\\extension", "..\\bin\\MPA_Wrapper.exe");

On the other hand, OS.Path.join works:

OS.Path.join("C:\\Users\\xxxx\\AppData\\Local\\MPA\\Firefox\\extension", "..\\bin\\MPA_Wrapper.exe");

Apparently PathUtils.joinRelative rejects .. segments. Is this change intentional?

Comment 5

[Masatoshi Kimura [:emk]]

According to the Native messaging manifests spec, path may be relative to the manifest itself on Windows. So I think this is a bug.

Comment 6

[Masatoshi Kimura [:emk]]

Attachment: Bug 1837830 - Do not use PathUtils.joinRelative to resolve relative path for Native messaging host. r?#extension-reviewers

To be more compatible with OS.File.join.

Comment 7

[EarlgreyTea]

Due to this bug, in Firefox 114, personal authentication using IC card reader / writer device does not work on various sites that provide Japanese government services.
I think this bug will have a big impact on the reliability of Firefox, so I think it should be set as a high priority.

Individual Number Card - Wikipedia

Comment 8

[Rob Wu [:robwu]]

(In reply to Masatoshi Kimura [:emk] from comment #4)

Apparently PathUtils.joinRelative rejects .. segments. Is this change intentional?

This change is not intentional. This is already the 4th unique regression caused by the changes associated with the osfile refactor. I'm going to take a thorough look at the desired path forward to minimize further compatibility risk.

I'm going to author patches to fast-track a reliable fix here (not just the bug reported here, but potentially others).

Comment 10

[Masatoshi Kimura [:emk]]

(In reply to Rob Wu [:robwu] from comment #8)

I'm going to author patches to fast-track a reliable fix here (not just the bug reported here, but potentially others).

Should I transfer the ownership of this bug?

Comment 11

[Rob Wu [:robwu]]

I'll do that. And thanks for your helpful report and regression range!

Comment 12

[Rob Wu [:robwu]]

Attachment: Bug 1837830 - Allow ".." relative path in NativeMessaging on Windows

NativeMessaging manifests on Windows are permitted to have relative
paths, including .. to traverse directories.

The original logic using OS.Path did not ".." in a special way, but the
replacement (PathUtils.joinRelative) from bug 1772932 does, by throwing.
To avoid the issue, we join these paths by string concatenation instead.
This is safe because:

• The left side of the path is already an absolute path, to the
  directory of the native manifest.

• The right side of the path is the command from the manifest. The path
  joining logic is only entered when the command is not an absolute
  path, which implies that the path is relative.

• Directory traversal "attacks" are not a concern here, because the
  "path" field is already specified to be an arbitrary path to an
  arbitrary binary, as part of the NativeMessaging API.

For completeness, this patch does not only add a test case for ".." in
relative paths (=the bug being fixed on Windows), but also ".." and "."
in absolute paths (=no change in behavior, already working on every OS).

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/99743dbea63b
Allow ".." relative path in NativeMessaging on Windows r=extension-reviewers,rpl

Comment 14

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/99743dbea63b

Comment 15

[Masatoshi Kimura [:emk]]

Please consider uplifting this to 115 and (hopefully) a dot release of 114.

Comment 16

[Rob Wu [:robwu]]

Comment on attachment 9338762 [details]
Bug 1837830 - Allow ".." relative path in NativeMessaging on Windows

Beta/Release Uplift Approval Request

• User impact if declined: Extensions cannot communicate with native messaging hosts that have been registered with a relative path containing ".." (on Windows). This includes an authentication mechanism for a Japanese government website (https://myna.go.jp) and the Adobe Acrobat extension.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Targeted change in NativeMessaging implementation, fully covered by unit tests.
• String changes made/needed: none
• Is Android affected?: No

Comment 17

[Donal Meehan [:dmeehan]]

Comment on attachment 9338762 [details]
Bug 1837830 - Allow ".." relative path in NativeMessaging on Windows

Approved for 115.0b6.

Comment 18

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/d219a92e610b

Comment 21

[Pascal Chevrel:pascalc]

Comment on attachment 9338762 [details]
Bug 1837830 - Allow ".." relative path in NativeMessaging on Windows

Approved for 104.0.2 next week, thanks.

Comment 22

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-release/rev/2a07ccbe5fab