Drag-Drop link generation - explorer creates Zone.Identifier [from address bar; recent change, MS Edge does not]
Categories
(Core :: DOM: Copy & Paste and Drag & Drop, defect)
Tracking
()
People
(Reporter: michael.donig, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Steps to reproduce:
drag link into explorer from Firefox address area.
open link results in windows warning "file of other computer"
Actual results:
Firefox version:
153.0 (64-bit) and 153.0.1 (64-bit)
Windows:
Windows 11 Pro 25H2. Build 26200.8875
Steps to reproduce:
- Open any website.
- Drag the URL from the Firefox address bar to the desktop or another NTFS folder.
- Open the created .url file.
Expected result:
The .url file should not receive a Zone.Identifier alternate data stream, matching the behavior of Microsoft Edge and Windows-created Internet shortcuts.
Actual result:
Explorer.exe creates a Zone.Identifier stream (ZoneId=3) for the .url file.
Windows displays the warning:
"This file came from another computer..."
Additional information:
- Microsoft Edge does not reproduce the issue.
- Creating a shortcut via "New -> Shortcut" does not reproduce the issue.
- ProcMon shows Explorer.exe creating the Zone.Identifier stream.
- Firefox itself does not create the ADS.
- Problem started approximately two weeks ago.
- checked also with Smart App & Browser Control disabled.
Expected results:
no zone identifier should be generated
|
||
Comment 1•3 months ago
|
||
The Bugbug bot thinks this bug should belong to the 'Firefox::Address Bar' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•3 months ago
|
||
This is almost certainly shared behavior with dragging a link from a web page, but in that context this is VERY intentional because the link DID come from another computer (the web server). A link that looks OK when you start dragging it can be spoofed and manipulated in many ways by that web page. But that definitely hasn't changed in years, let alone recently.
We did update Firefox to version 153, but that was only a week before you filed this and it often takes days or a week before people notice the update. Even in the unlikely case changed something that doesn't fit your "two weeks ago" timeline. Presumably you're on Windows 11 if you're getting OS updates. Could you give us a specific build number?
https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device#which-version-of-windows-do-i-have
I support it's possible we treat link-drags from the Address Bar differently since there's no opportunity for a web site to change it. That would be OK if it was something you typed, but if the URL came from a page navigation it still could be constructed in a very misleading way. If it were me I would treat the link as suspicious (and it simplifies the code), but maybe the folks responsible thought of it more as a "Bookmark" type action and made a special case. I can see that argument, but I don't know if that's the case
|
Reporter | |
Comment 3•3 months ago
|
||
Hi, thanks for the reply so far. I am on:
Windows 11 Pro N
25H2
Build 26200.8875 (see above)
experience pack 1000.26100.334.0
|
|
Reporter | |
Comment 4•2 months ago
|
||
problem got fixed in last update: https://bugzilla.mozilla.org/show_bug.cgi?id=2056865
|
||
Updated•2 months ago
|
Description
•