280492 - Files look like Windows Executables during download

Status: RESOLVED WORKSFORME

(Toolkit :: Downloads API, defect)

Description

[TGOS]

When I download a file (download dir is my desktop), the file is fist download
as a Windows executable file (<random>.exe) and finally renamed to the filename
I chose. This is undesired behavior.

Either it should download file directly with its correct name or even better, to
show that a file download is not complete, download it as <final-name>.download
and then strip the .download from the name once it is finished.

Comment 1

[TGOS]

Attachment: A screenshot example of the problem

Comment 2

[Doug]

I sometimes get the <random>.exe extension regardless of the real file extension. Other times, I get 
the <random> and the real file extension of the file (.zip, .sit, .tgz, etc...).

Ideally, the downloading file name should contain the source's file name, with a non-executable 
extension so that the file cannot be executed while it is not complete. <file-name>.download is a 
solution used by Safari and that works well.

This will aid in fixing the following:

1. If the random-name download file is moved before FireFox is done downloading it, it will not be 
renamed or deleted, just sitting there with its cryptic, random name, yet still executable. This is 
dangerous.

2. Adding a .download (or other similar and inert extension) will do several good things:
- Prevent the file to be executable based on file extension
- Indicates to the user that the file is being downloaded and belongs to a browser
- Indicates to other programs that the file is being downloaded and not to mess with with. As it is now, 
there is no extension or file attribute that can be programmatically looked at to see that the file is 
owned by a browser

Comment 3

[Michael]

On other platforms the ".part" extension is added until download is complete for
this very reason.

Comment 4

[Wayne Woods]

It does use *.part, but only after you hit save (with the "Ask me where to save
every file" option). Before then, it appears as a .exe file with a filename
composed of random numbers and letters. I presume this is just some kind of
placeholder file

I suspect this is why all my downloads have old-style MS Excel file icons until
they're completed. Since the file started out as a .exe, the system probably
guesses that it belongs to MS Office, and then since it has no idea what a .part
file is, it just leaves it as Excel. Just my guess anyway.

It just looks like whoever first coded the file saving part of the download code
wasn't thinking cross-platform at the time.

Comment 5

[Wayne Woods]

Just revisiting this bug.

When the initial "download actions" (i.e. "What should Firefox do with this file?") dialog box comes up, it seems that half the time it creates a placeholder file ending in the correct extension, and the other half it chooses ".exe" as the suffix instead. But the choice of extension doesn't seem to be entirely random, it seems to occur in blocks...

For example, you can try this by clicking on the test URL for this bug ( http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/firefox-1.6a1.en-US.mac.dmg ). After clicking on it, observe the "placeholder" file that appears on the desktop, then hit cancel before it proceeds to the save dialog. If I do this over and over, it might use a .dmg placeholder file for, say, the first dozen times. The, for no apparent reason that I can see, without me having done anything differently, it'll suddenly switch to using .exe instead. It might do this for another dozen times before switching back to .dmg again. Very weird.

Can anyone find the code where the ".exe" is, in the first place? I haven't been able to track it down.

Comment 6

[Shawn Wilsher :sdwilsh]

The random stuff is a security feature actually.  We also added .part always to the filename, so this is WORKSFORME now.