245380 - .pl file executed with activestate perl when installed w/out asking

Status: RESOLVED WORKSFORME

(Firefox :: File Handling, defect, P4)

Description

[Jon Williams]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

Firefox appears to execute .pl files with perl blindly. This is a Bad Thing,
even if a cruddy application sets up the association in this way.

Reproducible: Always
Steps to Reproduce:
1. Install ActiveState Perl
2. Click a .pl file
Actual Results:  
perl runs

Expected Results:  
prompted to open with perl / save

Comment 1

[Jesse Ruderman]

http://music.calarts.edu/gongcastg2.pl is sent as "audio/x-pn-realaudio", which
is on Firefox's default list of mime types to open with the appropriate app.  (I
guess real uses the .pl extension for playlists.)  It sounds like Firefox is
passing the file to the default app for the *extension* after determining
whether to save/open it based on the *mime type*, creating this security hole.

Ben Goodger introduced Firefox's default mimeTypes.rdf in bug 223333.  

I haven't tried to reproduce this bug.

I don't know whether the hole exists without a default mimeTypes.rdf.  (If the
*user* chooses to always open .ogg files in Winamp, can a site serve a .pl file
as application/ogg and get it executed as a Perl script?)

I don't know whether you can exploit this hole with anything that comes with
Windows, or if it requires the victim to have ActiveState Perl.

Comment 2

[Daniel Veditz [:dveditz]]

I'm taking Jesse's comment as confirmation of this bug

Comment 3

[Ben Goodger (use ben at mozilla dot org for email)]

I decided I don't just want to prune the entries from mimeTypes.rdf, since
that's unfair to the majority of users that have never heard of activeperl. 

Moving this into 1.0 for more in-depth investigation. 

Comment 4

[Daniel Veditz [:dveditz]]

Jesse wrote me to say that he didn't intend his comments as a confirmation. I
just tried it and cannot reproduce with firefox build 20040607, and I do have
activestate perl installed with the .pl type mapped to perl.

That said, a default value of alwaysAsk=false for *any* useSystemDefault type
seems like a very, very bad thing if I'm understanding those settings correctly.

Comment 5

[Asa Dotzler [:asa]]

p4 priority - not a blocker. if a fully reviewed patch materializes, please
nominate for aviary approval. 

Comment 6

[Boris Zbarsky [:bzbarsky]]

So where is the Firefox-default mimeTypes.rdf?  lxr is just showing the same (empty) 
datasources that SeaMonkey uses as default....

Comment 7

[Daniel Veditz [:dveditz]]

Yes, bug 264265 backed out bug 223333 resulting in an empty default
mimetypes.rdf. I'm not entirely sure what this bug tracks now.

Comment 8

[Daniel Veditz [:dveditz]]

consolidating sg: markings