279478 - Automatic download of infected EXE file

Status: RESOLVED DUPLICATE of bug 232564

(Toolkit :: Downloads API, defect)

Description

[Ken Cooper]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0 (MOOX M3)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0 (MOOX M3)

While visiting the aforementioned URL, a download automatically starts without
user prompting.

Reproducible: Always

Steps to Reproduce:
1. Visit the site.
2.
3.

Actual Results:  
The file 'default.exe' trys to download automatically.

Expected Results:  
Prohibited any download without user prompting.

Comment 1

[Kevin Goodsell]

More information can be found in the thread that prompted this bugzilla entry:

http://forums.mozillazine.org/viewtopic.php?t=205948

From that thread, my proposed resolution:

"Seems to me that Firefox shouldn't pre-download files when the download is
started automatically by viewing the page. There should have to be some form of
user action before a download starts. In other words, if I click a download
link, pre-downloading is fine. If I visit a page that starts a download
automatically, it should not actually start downloading until I've OKed it."

Comment 2

[Matthias Versen [:Matti]]

this is a wontfix. The download is stored in the temp directory (hidden under
windows9 under a random name and it's deleted if you close FF.

There is no security risk...

Comment 3

[Matthias Versen [:Matti]]

no security risk but other isues

Comment 4

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 129923 ***

Comment 5

[Ken Cooper]

(In reply to comment #2)
> this is a wontfix. The download is stored in the temp directory (hidden under
> windows9 under a random name and it's deleted if you close FF.
> 
> There is no security risk...

I did not submit this bug as a security risk.

This is an annoyance and one that does put an fx user at a personal risk. I
would come to expect more from this browser. Popups are also an annoyance and
not a risk, but they do not put an end user at risk. Sorry to hear you feel this
is not worth fixing.

Comment 6

[José Jeria]

(In reply to comment #2)
> this is a wontfix. The download is stored in the temp directory (hidden under
> windows9 under a random name and it's deleted if you close FF.

This is a Firefox autodownload issue, file is not deleted when  you close Firefox.

Comment 7

[Mike Connor [:mconnor]]

This is a duplicate, but not of the bug it was already duped to.

Comment 8

[OstGote!]

see bug 55307 and bug 69938, so if the dialog prompts the file download is
already running

Comment 9

[Phil Ringnalda (:philor)]

It is indeed a dup, though its alter ego may not yet realize that it will be expected to not only warn, but not start downloading while the warning is up.

*** This bug has been marked as a duplicate of 232564 ***