1966256 - v138.0.1 Severely Broken - Can't view any message - if anything in profile was using UNC path

Status: RESOLVED FIXED

(Thunderbird :: General, defect, P1)

Description

[Robert Chapin]

Steps to reproduce:

Ppgrade from v136.0 or v138.0 to v138.0.1 (on two separate machines).

Actual results:

It is impossible to view any message in Thunderbird in v138.0.1.

Expected results:

Should have offered upgrade or downgrade. Troubleshoot Mode did not fix the problem.

Comment 1

[Robert Chapin]

Workaround:

1. Open Thunderbird.
2. Go to Settings.
3. Disable automatic updates by selecting, "Check for updates, but let me choose whether to install them".
4. Close Thunderbird.
5. Download "Thunderbird Setup 138.0.exe" from https://download.mozilla.org/?product=thunderbird-138.0-SSL&os=win64&lang=en-US
6. Install v138.0 over v138.0.1.
7. Open Thunderbird.

Problem solved for now.

Comment 2

[Magnus Melin [:mkmelin]]

I don't know what would have caused that.
We'd need to see at least errors from the Error Console (Ctrl+Shift+J)

Comment 3

[Robert Chapin]

Steps to reproduce this bug after the downgrade:

1. Open Thunderbird.
2. Upgrade from v138.0 to v138.0.1 via the Help > About dialog.
3. Restart Thunderbird and appropriate user profile.
4. Press Ctrl+Shift+J
5. Click on any message in any folder.

Actual results:

It is impossible to view any message in v138.0.1. The Error Console displays the following exception:

Uncaught NS_ERROR_UNEXPECTED: Component returned failure code: 0x8000ffff (NS_ERROR_UNEXPECTED) [nsIMsgMessageService.loadMessage]
    displayMessage chrome://messenger/content/aboutMessage.js:393
    displayMessage chrome://messenger/content/message-pane.mjs:359
    _onSelect chrome://messenger/content/about3Pane.js:4668
    handleEvent chrome://messenger/content/about3Pane.js:4459
    onSelectionChanged chrome://messenger/content/tree-view.mjs:1703
    _selectSingle chrome://messenger/content/tree-view.mjs:1505
    handleEvent chrome://messenger/content/tree-view.mjs:422
aboutMessage.js:393

PLEASE REOPEN THIS BUG AND SET SEVERITY

Comment 4

[Hartmut Welpmann [:welpy-cw]]

Regression from Bug 1958580?

Comment 5

[Magnus Melin [:mkmelin]]

What is the exact path to your mails?

Comment 6

[Magnus Melin [:mkmelin]]

(In reply to Hartmut Welpmann [:welpy-cw] from comment #4)

Regression from Bug 1958580?

But no, that's not on 138 yet.

Comment 7

[Hartmut Welpmann [:welpy-cw]]

(In reply to Magnus Melin [:mkmelin] from comment #6)

(In reply to Hartmut Welpmann [:welpy-cw] from comment #4)

Regression from Bug 1958580?

But no, that's not on 138 yet.

I found https://hg-edge.mozilla.org/releases/comm-release/rev/68f06fca9d9dcba146b4f6eb45144de8885805e9.

Comment 8

[Robert Chapin]

File path to the profile? It's UNC yes. According to About Profiles it's not even on the FQDN, just \server\share\folder

Comment 9

[Robert Chapin]

FYI the UNC syntax is set by Thunderbird when creating a profile on a redirected folder in Windows. i.e. My Documents is not located on a local drive. So, this is not something set by the user. I could attempt a workaround with a mapped drive letter, but that might imply Thunderbird is dropping support for Windows folder redirection.

Comment 10

[Robert Chapin]

Just brainstorming here but if you're going to "disallow UNC access" that's a substantial feature change and it requires more than a white screen of death for the inbox.

Comment 11

[Corey Bryant]

Any chance this is fixed by bug 1964145? We might be able to release a 138.0.2 if needed.

Comment 12

[Magnus Melin [:mkmelin]]

No that would not affect it.
Robert: can you provide the path to the folder? Send me an email if you don't want to have it in the bug (mkmelin at thunderbird.net)

Comment 13

[Magnus Melin [:mkmelin]]

Attachment: Bug 1966256 - Block only remote UNC mailbox access outside the profile. r=BenC

Allow UNC paths, but if remote, don't. So check for dot (domain, or ipv4), ":" (ipv6) or % (somehing escaped...)

Comment 14

[Robert Chapin]

Windows folder redirection likely allows and encourages full domain names. Would you like me to check?

Comment 15

[Magnus Melin [:mkmelin]]

It does but that can't be allowed.

Comment 16

[Robert Chapin]

I understand. If you think all or nothing is better and keep the UNC block, I would also understand some kind of informative feedback in the profile manager and the Inbox.

Comment 17

[Ben Campbell]

I've got some questions.

I'd assume a lot of people in corporate or institutional settings would have a shared home directory (i.e /Users/Bob/Apps/...whatever it is on windows...). These would be "remote" hosts, right?
Do these always show up as as UNC paths, or would shared drives be more likely? ("Z:", say)?
(Sheesh. Shows how long it's been since I used windows file-sharing!)

I'd guess we'd want to support profile dirs on remote hosts, right?
But supporting "mailbox://" urls which hit arbitrary servers would not be good.

Comment 18

[Magnus Melin [:mkmelin]]

Agreed In corporate environments it's common to have the user drive (really) mapped somewhere else, but I think those would be mapped to a drive so you can set it all up when you log on. Mapped drives would show as "normal" local file paths.

I'd guess we'd want to support profile dirs on remote hosts, right?

Yes, though I do think it needs to be a mapped drive, or then you'd have to whitelist it. I don't see any other way to fix it.

But supporting "mailbox://" urls which hit arbitrary servers would not be good.

Right, we fixed that, which caused this bug.

Comment 19

[SUPERJET]

"In my environment, I confirmed that the same issue occurred after updating Thunderbird from version 128.10.0 to 128.10.1."

Comment 20

[Wayne Mery (:wsmwk)]

Might be more common on non-Windows computers? Like mac?

Comment 21

[Magnus Melin [:mkmelin]]

On unixy systems I'd assume you really just mount the path internally and don't use them directly too much.

Comment 22

[Robert Chapin]

Maybe I'm over-thinking this but why isn't it a simple matter of matching the profile path? Then you wouldn't have to block anything.

Comment 23

[Ben Campbell]

(In reply to Robert Chapin from comment #22)

Maybe I'm over-thinking this but why isn't it a simple matter of matching the profile path? Then you wouldn't have to block anything.

I think I agree: The core intention here is really to confine mailbox URLs to only see files within that profile, right?
I'd suspect matching arbitrary paths isn't entirely trivial - you have to normalise the paths first (ie "foo/../bar/..." -> "bar/...") and handle percent-encoding and various other things - but I know it can be done.
That'd seem to be the "right" solution.

(ultimately, I think we need to kill off using raw paths in mailbox URLs entirely - it just seems like asking for trouble. mailbox URLS should just be of the form: mailbox:{server}/{folder}/msgKey. But that's a bigger issue :- ).

(In reply to Magnus Melin [:mkmelin] from comment #18)

Agreed In corporate environments it's common to have the user drive (really) mapped somewhere else, but I think those would be mapped to a drive so you can set it all up when you log on. Mapped drives would show as "normal" local file paths.

I dunno... from a quick web search on "windows folder redirection" it kind of sounds like that's the way admin policy is supposed to be handled on windows these days... (I'm a bit out of touch with this stuff). And Folder Redirection shows up to us as UNC paths, so we need to support them robustly.

Comment 24

[Wayne Mery (:wsmwk)]

Early reports via support:

• https://support.mozilla.org/en-US/questions/1512216
• https://support.mozilla.org/en-US/questions/1512126

Comment 25

[Robert Chapin]

I did some more testing and would like to point out two things:

Microsoft requires UNC paths for folder redirection. Let's not confuse that with user homes.

https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-using-group-policy

"The path must be in the form \server\share\FolderName."

I was able to manually change the user folder Location settings to a mapped drive letter path in my Windows profile. While every program I use, except Thunderbird, supports UNC paths, I discovered my version of Acrobat fails to install if any user folder points to a mapped drive letter. It simply throws an invalid drive error and then dumps to the installation aborted page of the wizard.

So as a user, if Thunderbird goes the direction of blocking UNC paths forever, I will have to set up a drive letter dedicated to my Thunderbird profile.

Comment 27

[Wayne Mery (:wsmwk)]

A notation in 128.10.1 and 138.0.1 release notes for this known issue would probably be a good idea.

Not an overwhelming number of user reports, but I estimate only 10% of users are on an affected release, so can expect many more reports. Can we ship something quick, like 1-2 days to help users safely use networked resources, and then in follow up bugs add as much accommodation as possible for reasonable use cases, as quickly as possible?

Comment 28

[SUPERJET]

Not an overwhelming number of user reports, but I estimate only 10% of users are on an affected release, so can expect many more reports. Can >we ship something quick, like 1-2 days to help users safely use networked resources, and then in follow up bugs add as much accommodation as >possible for reasonable use cases, as quickly as possible?

I am writing from a corporate environment where we are currently experiencing significant issues related to this problem.
If at all possible, I would also like to request your urgent attention and support on this matter.

A notation in 128.10.1 and 138.0.1 release notes for this known issue would probably be a good idea.

Additionally, as you mentioned:
It may be helpful to include this known issue in the release notes for versions 128.10.1 and 138.0.1.
I agree, and I would like to add that the Thunderbird release notes page currently does not list version 128. I hope this can be addressed as well, so users relying on the ESR version can stay properly informed.

Comment 29

[Magnus Melin [:mkmelin]]

(In reply to Robert Chapin from comment #22)

Maybe I'm over-thinking this but why isn't it a simple matter of matching the profile path? Then you wouldn't have to block anything.

It's a good idea! But, there's always a but, individual servers may also have their location somewhere else...

Comment 30

[Magnus Melin [:mkmelin]]

Updated patch under review now. It would always allow access for paths under the profile.

I'm curious though for people affected by this: if you put the profile under UNC - do you only use that for an environment with stationary desktops and very stable network? How would (does it?) work if you have a laptop and try starting Thunderbird when away, or on flaky connection?

Comment 32

[Ben Campbell]

(In reply to Magnus Melin [:mkmelin] from comment #29)

(In reply to Robert Chapin from comment #22)

Maybe I'm over-thinking this but why isn't it a simple matter of matching the profile path? Then you wouldn't have to block anything.

It's a good idea! But, there's always a but, individual servers may also have their location somewhere else...

But I think that's OK: a deliberate choice has already been made - either by the user or the machine admin - to locate the profile remotely.
So as long as the mailbox url is within that path, it should be allowed.

(Just as a breadcrumb for myself, in case we need to do some more robust UNC parsing, there's a ABNF syntax here: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc )

Comment 33

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/a9e5cb44e92e
Block only remote UNC mailbox access outside the profile. r=BenC

Comment 34

[Robert Chapin]

(In reply to Magnus Melin [:mkmelin] from comment #30)

I'm curious though for people affected by this: if you put the profile under UNC - do you only use that for an environment with stationary desktops and very stable network? How would (does it?) work if you have a laptop and try starting Thunderbird when away, or on flaky connection?

Laptops require LAN or VPN access. When offline, the profile-not-found message is expected.

Comment 35

[Magnus Melin [:mkmelin]]

Comment on attachment 9487963 [details]
Bug 1966256 - Block only remote UNC mailbox access outside the profile. r=BenC

Uplift Approval Request

• Please state case for uplift consideration and ensure bug severity is set: Regression
• User impact if declined: Cannot access mail at UNC path
• Is this code covered by automated tests?: No
• Has the fix been verified in Daily?: Yes
• Has the fix been verified in Beta?: No
• Needs manual test from QA?: Yes
• If yes, steps to reproduce: Set up a profile at an UNC path (a windows share like \yoursever\foo. Access (non-imap) mail on that profile.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): If it's hitting this code, it would be broken anyway.
• String changes made/needed: none

Comment 36

[Corey Bryant]

Comment on attachment 9487963 [details]
Bug 1966256 - Block only remote UNC mailbox access outside the profile. r=BenC

[Triage Comment]
Approved for beta
Approved for release
Approved for esr128

Comment 37

[Corey Bryant]

Thunderbird 139.0b4:
https://hg.mozilla.org/releases/comm-beta/rev/adbe3988a04e

Comment 38

[Corey Bryant]

Thunderbird 138.0.2:
https://hg.mozilla.org/releases/comm-release/rev/2c197311b7a2

Comment 41

[Corey Bryant]

Thunderbird 128.10.2esr:
https://hg.mozilla.org/releases/comm-esr128/rev/6443e920c1d2

Comment 42

[Corey Bryant]

Robert, would you be able to give 139.0b4 a quick test? It is currently available from:
https://ftp.mozilla.org/pub/thunderbird/candidates/139.0b4-candidates/build1/

Comment 43

[Corey Bryant]

128.10.2esr is failing to find MsgLogToConsole4: https://treeherder.mozilla.org/logviewer?job_id=509123195&repo=comm-esr128&lineNumber=14460
I think we need to adjust the 2nd parameter on the call to MsgLogToConsole4 since we don't have bug 1911352 in 128
I'm going to switch the 2nd parameter to NS_LITERAL_STRING_FROM_CSTRING(__FILE__)

Comment 44

[Robert Chapin]

v139.0b4 installed.

• Inbox default view has changed to "Cards". Changing back works.
• Two profiles, one for mapped drive path, one for UNC path, both working when switching the default profile and restarting TB.
• v138.0.1 stays installed and reports the profile has been modified by a newer version.

A likely unrelated issue: When I shuffled the paths around to make it easier to create a mapped drive letter, I learned in v138.0.1 it is impossible to use a root path in the profile settings. In other words, if I try to create a profile at Z:\ the "Select Folder" button closes the Choose Profile Folder dialog but has no other effect. It feels like there is missing feedback here. The workaround is to map the drive letter such that the profile root is not the same as the mapped drive root.

Comment 45

[Corey Bryant]

Thunderbird 128.10.2esr (back out):
https://hg.mozilla.org/releases/comm-esr128/rev/eb878903484a

Comment 46

[Corey Bryant]

Thunderbird 128.10.2esr:
https://hg.mozilla.org/releases/comm-esr128/rev/7837c914bfaf

(with NS_LITERAL_STRING_FROM_CSTRING(__FILE__) change)

Comment 47

[Wayne Mery (:wsmwk)]

Torsten, superjet,

Can you also test the download at https://ftp.mozilla.org/pub/thunderbird/candidates/139.0b4-candidates/build1/win64/en-US/Thunderbird%20Setup%20139.0b4.exe ?

Please post your results.

Comment 48

[ACIT]

(In reply to Magnus Melin [:mkmelin] from comment #30)

I'm curious though for people affected by this: if you put the profile under UNC - do you only use that for an environment with stationary desktops and very stable network? How would (does it?) work if you have a laptop and try starting Thunderbird when away, or on flaky connection?

RDS environment, with profiles/mail/folders etc in SAN.
Is there a download for 128.10.2esr? Apologies, looked at Corey's link above and couldn't see an executable?

Comment 49

[SUPERJET]

トルステン、スーパージェット、
https://ftp.mozilla.org/pub/thunderbird/candidates/139.0b4-candidates/build1/win64/en-US/Thunderbird%20Setup%20139.0b4.exeでダウンロードをテストすることもできますか?
結果を投稿してください。

We confirmed that the issue occurred in our environment when installing version 139.0b3, and that the issue was resolved after installing version 139.0b4.

Comment 50

[Ronny Chen]

(In reply to Wayne Mery (:wsmwk) from comment #47)

Torsten, superjet,

Can you also test the download at https://ftp.mozilla.org/pub/thunderbird/candidates/139.0b4-candidates/build1/win64/en-US/Thunderbird%20Setup%20139.0b4.exe ?

Please post your results.

Thanks for the test build.
I’ve installed and tested version 139.0b4 — the issue with opening EML files from NAS is resolved.
Appreciate your support!

Comment 51

[Wayne Mery (:wsmwk)]

(In reply to ACIT from comment #48)

RDS environment, with profiles/mail/folders etc in SAN.
Is there a download for 128.10.2esr? Apologies, looked at Corey's link above and couldn't see an executable?

https://ftp.mozilla.org/pub/thunderbird/candidates/128.10.2esr-candidates/build1/win64/en-US/Thunderbird%20Setup%20128.10.2esr.exe

Comment 54

[Corey Bryant]

We have fixes available in 138.0.2 and 128.10.2esr candidates if anyone wants to give it a test and provide feedback before we release.
https://ftp.mozilla.org/pub/thunderbird/candidates/138.0.2-candidates/build1/
https://ftp.mozilla.org/pub/thunderbird/candidates/128.10.2esr-candidates/build1/

Comment 55

[Corey Bryant]

We could particularly use a test of https://ftp.mozilla.org/pub/thunderbird/candidates/128.10.2esr-candidates/build1/ if anyone has cycles.

Comment 56

[Corey Bryant]

This has been tested successfully for 128.10.2esr. We're going to release now.