186304 - /etc/mailcap is interepreted incorrectly - can lead to external handlers being executed incorrectly

Status: RESOLVED DUPLICATE of bug 83305

(Core Graveyard :: Plug-ins, defect)

Description

[Christopher Blizzard (:blizzard)]

Report from alan cox:

When it scans the mailcap file to look for a helper mozilla seems to pull
the app name but not any arguments from the mailcap file. 

Demo

	touch fred.smil
	echo "application/smil; gedit wombat %s"
	mozilla file:/wherever/fred.smil

	Run with - says gedit

Up pops a gedit window - but wombat wansn't in the arguments.

Unfortunately the same applies for "gv" and "gv -safer". For some setups
plugger will save peoples backsides, but not for all.

Comment 1

[rubydoo123]

reassign

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

helper apps aren't plugins (but we don't really have a good component for them),
and this is probably bz's bug

Comment 3

[Peter Lubczynski]

cvs blame shows most of the mailcap code in
exthandler/unix/nsOSHelperAppService.cpp is owned by bz, --->punting

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yep.  This has been filed for a while now -- the api design prevents the Unix 
back end code from passing out command-line args and the 'gv -safer' example is 
precisely the one that's been raised in the relevant bug...  Too bad the API 
problem got ignored by the owners of the relevant apis until very recently.

I kept meaning to add a bunch of code to work around the broken apis, but 
recently I've been putting most of the time I have for this stuff into fixing 
the API instead...

Oh, and see bug 57420 for the api issue...

*** This bug has been marked as a duplicate of 83305 ***

Comment 5

[Mitchell Stoltz (not reading bugmail)]

bz,
  What's the security risk here? If there's a risk, bug 83305 should be marked
confidential. If not, this one should be public.

Comment 6

[Boris Zbarsky [:bzbarsky]]

The security issue is basically that we will run a helper app in a less secure 
mode than the user desired.  In other words, not any more of a security risk 
than any helper app, imo.

Comment 7

[Christopher Blizzard (:blizzard)]

No, it's a pretty major problem since some helper applications can be run in
safer modes than the default. (gv is a good example.)

Comment 8

[Boris Zbarsky [:bzbarsky]]

Yes, I agree it's a major problem because we're giving the user a false sense 
of security.  I fail how that would be corrected by marking anything 
confidential.

Comment 9

[timeless]

can't we just release note that people should write wrapper scripts which handle
this for the time being?

Comment 10

[Daniel Veditz [:dveditz]]

Dupe of public bug, clearing confidential flag