1892115 - Secure file download corrupt file on http connection

Status: RESOLVED DUPLICATE of bug 1892069

(Core :: DOM: Security, defect)

Description

[info]

Steps to reproduce:

Hello, it's no longer possible to download files using an http connection with the new download protection using primefaces.
You can test it going on this site http://www.primefaces.org:8080/showcase/ui/file/download.xhtml and click on download button (ajax download works)

Actual results:

The files are downloaded, but they are corrupted

Expected results:

Files must not be corrupted.
In chrome it works

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Donal Meehan [:dmeehan]]

Thanks for the report.
When downloading the file in the reproductions steps, did you notice the downloads panel opened?
Informing you of a potential security risk, then providing the option to Allow download or Remove file

Comment 3

[info]

(In reply to Donal Meehan [:dmeehan] from comment #2)

Thanks for the report.
When downloading the file in the reproductions steps, did you notice the downloads panel opened?
Informing you of a potential security risk, then providing the option to Allow download or Remove file

Yes, but after clicking on Allow download, the file downloaded it's corrupted.
The download works fine if i set to false the configuration dom.block_download_insecure in http connection or if it's on ssl

Comment 5

[Yannis Juglaret [:yannis] (Away until May 11)]

I can reproduce the issue in Nightly, it downloaded a corrupt file. This issue is also mentioned here on Reddit.

Comment 6

[Yannis Juglaret [:yannis] (Away until May 11)]

In fact the downloaded file contains the HTML contents of the source page instead of the JPG image that was supposed to get downloaded. The file name is still that of the JPG image though.

Comment 7

[Christoph Kerschbaumer [:ckerschb}]

We are tracking exactly that problem over within Bug 1892069.