277046 - HTML message: click on link to attached part is treated per the file extension, not the content-type

Status: RESOLVED INVALID

(MailNews Core :: MIME, defect)

Description

[Mike Cowperthwaite]

xref bug 276991.

If an message contains a link to an attached part, clicking the link is handled 
according to the part's filename rather than its content-type.  This is not 
necessarily a problem, because the handling comes back thru Mozilla rather than 
being launched.  It appears the behavior is:
  Look up the MIME type associated to the extension in the registry
  Look up the MIME type in Mozilla's Helper Applications

However, in certain messages, it is possible to view the attachment in the 
attachment panel (in the plain-text portion); and double-clicking on that will 
open the file according to the Content-Type associated.

Test case follows.

Comment 1

[Mike Cowperthwaite]

Attachment: Sample email

This message contains a text/plain and text/html parts (as alternatives) and an
'related' .WAV file which is mis-specified as "application/pdf".

To reproduce:
1) Integrated message into email (Moz 1.7+).
2) Configure Helper Applications with:
   application/pdf: Open With Default App
   audio/wav: <no entry>
3) Configure system registry such that HKCR\.wav has a string value
      Content-Type = audio/wav
4) View the message As Original (or Simple) HTML
5) Click on the link.  Get a "Mozilla does not know how to handle audio/wav"
message; instruct it to "Open With Default App", always henceforth
6) View the message As Plain Text.
7) Double-click the attachment icon

Actual results:
5) Mozilla claims that the linked data is type "audio/wav" (determined via file
extension and system registry), plays sound eventually

7) Mozilla attempts to open WAV file in Acrobat, gives error

Expected results:
5) *and* 7) Mozilla attempts to open WAV file in Acrobat, gives error

Comment 2

[Mike Cowperthwaite]

I guess, looking at other bugs related to Windows extension handling, this 
should be a major bug too.  CC'ing some people familiar with the problem domain.

Comment 3

[Boris Zbarsky [:bzbarsky]]

It sounds like the mailnews channel in question just doesn't report the
content-type specified in the part...  I'm pretty sure we have existing bugs on
this, languishing.

Comment 4

[(not reading, please use [e-mail] instead)]

sorry for the spam.  making bugzilla reflect reality as I'm not working on these bugs.  filter on FOOBARCHEESE to remove these in bulk.

Comment 5

[buovjaga]

Still repro.

Thunderbird 52.0.1 (32-bit)
Windows 7 64-bit

Comment 6

[Max Emig [:maxe]]

Attachment: Screenshot of open dialog.png

We have an attachment linked that can be opened as of right now both in HTML (via link) and plain text mode (as a standard attachment), so the data it contains can be accessed either way.

We should not break this flow based on a string the user never gets to see.

In terms of security implications, a mail gateway scanning for viruses doesn't care about Content-Type either, and linking vulnerable software to open any filetype automatically is insecure either way and not the default behaviour.