1945705 - Can still spoof via long runs of %0A in filename download (firefox android) (bypass of 1906024)

Status: RESOLVED FIXED

(Firefox for Android :: Downloads, defect)

Description

[Hafiizh]

Attachment: downloadspoofk1.html

after fixed https://bugzilla.mozilla.org/show_bug.cgi?id=1906024 the special characters have been sanitized to be "" , but i try using %0A on filename, the %0A is not sanitized to be "" it lead to spoof

step to produce:

1. open http://103.186.0.20/downloadspoofk1.html or downloadspoofk1.html
2. click "open" button
   impact : victim can be spoofed will think that it is a document file and even though it is an apk file

Comment 1

[Hafiizh]

Firefox Version : Nightly 136.0a1 (Build #2016071263)

Comment 2

[Hafiizh]

Attachment: spooffile.mp4

Comment 3

[Hafiizh]

Attachment: downloadspoofk1.html

Comment 4

[Daniel Veditz [:dveditz]]

How or where does the %0A get turned into \n? percent-encoding is for URLs, it shouldn't mean anything in the download name attribute! And if we are turning it into a newline, why didn't the \s in the regexp catch it? My first reaction was to worry that we weren't doing a multi-line regexp, but we have a testcase that handles "new\u000Aline" correctly.

For comparison, on Desktop the '%' gets dropped somewhere and "0A" are left a literal characters in the name.

Comment 5

[Rahul Sainani [:rsainani]]

Sorry for the delay, I was OOO and only now have I caught up to this and investigated this.

[:dveditz] We are not decoding before (or as part of) sanitizing the file name. The usage that causes this sanitizes the file name and then decodes this. https://searchfox.org/mozilla-central/source/mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt#1262

I think we should decode before sanitizing, that will enable regex to sanitize the file name as intended, it's not perf intensive and will solve this issue. Let me know your thoughts on this when you can.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:007, could you have a look please?

For more information, please visit BugBot documentation.

Comment 7

[Titouan Thibaud [:titouan]]

Attachment: Bug 1945705 - Fix malformed download filename extracted from contentDisposition

Comment 8

[Titouan Thibaud [:titouan]]

Attachment: Bug 1945705 - Improve tests for Download filename extraction from contentDisposition

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9f2903340566
Fix malformed download filename extracted from contentDisposition r=android-reviewers,rsainani

Comment 10

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/463b21eac2e8
Backed out changeset 9f2903340566 for causing lint failures on GeckoEngineSession.kt. CLOSED TREE

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

linting failure(AC task also reports unused import)
TEST-UNEXPECTED-ERROR | /builds/worker/checkouts/gecko/mobile/android/android-components/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt:56:1 | Unused import (standard:no-unused-imports)

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fe35a25cb754
Fix malformed download filename extracted from contentDisposition r=android-reviewers,rsainani

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/fe35a25cb754

Comment 14

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

a month ago, RyanVM placed a reminder on the bug using the whiteboard tag [reminder-test 2025-05-28] .

titouan, please refer to the original comment to better understand the reason for the reminder.

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/97a92129cf8c
Improve tests for Download filename extraction from contentDisposition r=android-reviewers,rsainani

Comment 17

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/97a92129cf8c