Closed Bug 1842168 Opened 11 months ago Closed 10 months ago

Passing URLs to external helpers on windows sometimes decodes special chars

Categories

(Firefox :: File Handling, defect)

Firefox 115
defect

Tracking

()

RESOLVED DUPLICATE of bug 1781264

People

(Reporter: pch, Unassigned)

References

Details

Steps to reproduce:

Register a URL helper in e.g. "[HKEY_CURRENT_USER\Software\Classes\seafile\shell\open\command]" for scheme seafile://
Let firefox follow a seafile:// link with special chars, e.g. seafile://foo/Ö.pdf

Actual results:

Using sysinternals procmon I see the uft-8 escape %C3%96 appears as literal Ö in the command line field as passed to the program "seafile-drive".

Spaces and such special chars remain in escape, only non-ascii characters get decoded to ANSI.

Curiously, this does not happen when I change the helper preferences in firefox settings and e.g. call a custom program, there the special char in the URL does not get decoded.

Expected results:

The uft-8 escape should not have been decoded in no case.

I tried to get a log:

"C:\Program Files\Mozilla Firefox\firefox.exe" -MOZ_DISABLE_CONTENT_SANDBOX=1 -MOZ_LOG=HelperAppService:4 -MOZ_LOG_FILE=C:\tmp\all.log

But the output file is empty all the time, even when run as Administrator.

I am not in any way familiar enough with the OS and what I could do to debug further. Please advise! Tentatively setting this as a "defect".

Component: Untriaged → File Handling

One more observation using sysinternals procmon.exe: When setting the firefox preference to call the "system standard" application as a custom application, the url gets passed with all special characters as escape sequences, no unescaping takes place. I see that as a sure indication, that the problem is within firefox:

Perhaps code goes a different path depending on whether a "system default" handler gets the url or a custom user handler gets it?

Perhaps though, because the default handler specifies a named command argument "-f %1"?

I don't see how ProtocolHandler functions pass on the argument here - https://searchfox.org/mozilla-central/source/uriloader/exthandler/win/nsOSHelperAppService.cpp - maybe this line here https://searchfox.org/mozilla-central/source/uriloader/exthandler/win/nsMIMEInfoWin.cpp#291

(In reply to Hungerburg from comment #0)

"C:\Program Files\Mozilla Firefox\firefox.exe" -MOZ_DISABLE_CONTENT_SANDBOX=1 -MOZ_LOG=HelperAppService:4 -MOZ_LOG_FILE=C:\tmp\all.log

MOZ_... are environment variables, and you're using them as commandline arguments here, which isn't recognized.

I'd recommend logging from about:logging instead, which is much more user-friendly.

This looks like it's basically the same as bug 1781264.

Status: UNCONFIRMED → RESOLVED
Closed: 10 months ago
Duplicate of bug: 1781264
Resolution: --- → DUPLICATE
See Also: → CVE-2021-43541
You need to log in before you can comment on or make changes to this bug.