1916193 - Stop exempting the Windows Store protocol handler from permissions checks in Firefox (was: Don't allow Firefox to automatically open the Windows Store app upon clicking a Windows Store URL)

Status: VERIFIED FIXED

(Firefox :: File Handling, defect)

Description

[:Gijs (he/him)]

(Cloned from bug 1913147)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0

Steps to reproduce:

This is related to a bug that was closed without any change to this issue (bug 1567206). <snip>

Open any Windows store page on a Windows version of Firefox, e.g.
https://apps.microsoft.com/detail/9nksqgp7f2nh?hl=en-us&gl=US
Click on the "View in Store" button

Actual results:

The Windows App Store in the operating system opens

Expected results:

Firefox should prompt for permission before opening the Windows store app.

---

This was previously discussed in bug 1567206. The separate default comes from bug 866065, before we had per-site permissions for protocols. The UX now is better, and we're no longer trying to build for Metro and its single-window modes, so I think it's fine to provide the same security functionality as Chrome, rather than following Edge (which opens without prompting).

Comment 1

[:Gijs (he/him)]

Attachment: Bug 1916193 - stop always allowing opening the Windows Store, r?dveditz!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/20660a3f6cfa
stop always allowing opening the Windows Store, r=dveditz

Comment 3

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/20660a3f6cfa

Comment 4

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:Gijs, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox131 to wontfix.

For more information, please visit BugBot documentation.

Comment 5

[:Gijs (he/him)]

I think this is fine to ride the trains. We can evaluate ESR once this has been out on release.

Comment 6

[Monica Chiorean]

I was able to reproduce the issue on Win11x64 using FF build 131.0a1 (2024-08-30).
Verified as fixed on Win11x64 using FF build 133.0a1 and 132.0b2. On Ubuntu 24.04 and Mac 12.6 this button is not present.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

(In reply to :Gijs (he/him) from comment #5)

I think this is fine to ride the trains. We can evaluate ESR once this has been out on release.

This has been on release for a couple cycles now. What are your thoughts on ESR?

Comment 8

[:Gijs (he/him)]

Attachment: Bug 1916193 - stop always allowing opening the Windows Store, r?dveditz!

Original Revision: https://phabricator.services.mozilla.com/D220810

Comment 9

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Users lack control over windows store behaviour
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: very low
• Explanation of risk level: this just changes some pref defaults
• String changes made/needed: No
• Is Android affected?: no

Comment 10

[:Gijs (he/him)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #7)

(In reply to :Gijs (he/him) from comment #5)

I think this is fine to ride the trains. We can evaluate ESR once this has been out on release.

This has been on release for a couple cycles now. What are your thoughts on ESR?

Sure, why not. :-)

Comment 11

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/38b1579734e2

Comment 12

[Monica Chiorean]

Verified as fixed on Win11x64 using FF build 128.6.0esr(20241218153108).