277999 - Option to disable RFC 2397 "data" URL scheme support

Status: RESOLVED WONTFIX

(Core :: Networking, enhancement)

Description

[Tod Beardsley]

In the referenced Full-Disclosure post, Darren Bounds mentions that binaries
base64-encoded binary data embedded as inline HTML elements per RFC 2397 are
able to bypass security screening devices (AV/IPS/IDS, etc.).

There ought to be a Web Features checkbox to toggle support for RFC 2397. (If I
were king of Mozilla, I'd remove RFC 2397 support entirely.)

This is related to bug 121795. In that bug, it is observed that if RFC 2397 were
fully supported, "odd things" would happen with standards-strict browsers on
memory-limited platforms.

This is a minor security problem, but due to the discussion on F-D, and the fact
the security problem lies more with the screening devices than with the Mozilla
software, I don't believe it needs to be marked confidential.

Comment 1

[timeless]

note: doing this will break at *least* view partial source, and probably other
things. please hurry up and break view partial source.

Comment 2

[werner]

Example for RFC2397-Problems (OS:WinNT4.0/Sp6, Mozilla/5.0 (Windows; U;
WinNT4.0; de-DE; rv:1.7.5) Gecko/20041108 Firefox/1.0)

http://aktuell.de.selfhtml.org/artikel/grafik/inline-images/index.htm

Click the Image with right Mouse Button, select "Grafik anzeigen" (english:
"View Image") -> Image is viewed normally in same Browsertab/window, but OS
hangs up totally. No more reaction on mouse movements & clicks or keyboard. 

Of course rarely used, but when happening, system hangup is not the best
reaction. ;-)

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Tod Beardsley]

This feature request remains pertinent. Sorry to be a nag, but RFC 2397 is just
plain silly, especially when one considers running Firefox (or any web browser)
on a limited resources platform.

Comment 5

[Hixie (not reading bugmail)]

data: URIs are used all over the place these days. However, I could see security
reasons for wanting to disable individual protocol handlers (not just data:), do
we have a pref for that?

Comment 6

[alanjstr]

Well, you could compile it without it.
http://lxr.mozilla.org/seamonkey/source/netwerk/build2/nsNetModule2.cpp#74

Comment 7

[Masatoshi Kimura [:emk]]

You can already set "network.protocol-handler.external.data" to true to disable the "data" scheme. Is this bug a request for UI?