1870879 - Mark of the Web zone identifier inconsistency with Chrome & Edge on blob: URIs

Status: NEW

(Toolkit :: Downloads API, defect, P3)

Description

[abruening]

Steps to reproduce:

Downloading a blob: file from an Intranet website that is marked as such on Windows with Firefox, Edge and Chrome.

Actual results:

Both Edge and Chrome do not apply a Mark of the Web zone identifier to the downloaded file, Firefox does.

Expected results:

Firefox should also not apply the Mark of the Web zone identifier to be consistent.

Comment 1

[abruening]

For testing: Add https://5509.github.io to Intranet or Trusted Sites in Windows' internet options and click the link on https://5509.github.io/demos/blob/ in the mentioned browsers.

Comment 2

[Daniel Bodea [:danibodea]]

I can confirm that if I download the file from test page https://5509.github.io/demos/blob/ and test its zone identifier, it will be 3.

Comment 3

[:Gijs (he/him)]

Does it work if you download a file directly from such a site (ie not a blob, but a "normal" http/https link)? E.g. using context menu + save link as on any normal link?

Comment 4

[Marco Bonardo [:mak]]

We pass the url to IInternetSecurityManager->MapUrlToZone
https://searchfox.org/mozilla-central/rev/9d88be0557a5bc39d3da288f9aff71414baa303e/toolkit/components/downloads/DownloadIntegration.sys.mjs#518
https://searchfox.org/mozilla-central/rev/9d88be0557a5bc39d3da288f9aff71414baa303e/toolkit/components/downloads/DownloadPlatform.cpp#269

Comment 5

[Alexander Brüning]

(In reply to :Gijs (he/him) from comment #3)

Does it work if you download a file directly from such a site (ie not a blob, but a "normal" http/https link)? E.g. using context menu + save link as on any normal link?

Yes, it works as expected when it's a normal download. I've tried to look at the code that applies the mark and it seems like it doesn't handle blob: URIs, so it falls back to the default of applying the mark.

Comment 6

[:Gijs (he/him)]

Thanks! So yes, looks like we need to add special handling in https://searchfox.org/mozilla-central/rev/14dc8f0e748d44778a02ffcf9ebcda3851b2bf9e/toolkit/components/downloads/DownloadIntegration.sys.mjs#518 to check for blob URIs and find their origin, then use that to ask Windows to map to a zone.