339788 - User Pref for some localfilelinks.sites entries in user.js being ignored.

Status: RESOLVED INVALID

(Core :: Security: CAPS, defect)

Description

[Scott Pedigo]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

I added entries to my user.js file to allow access to local file links on pages served from selected domains, i.e. from our own servers. This worked fine for a simple domain, such as:
user_pref("capability.policy.localfilelinks.sites", "https://www.mydomain.com");

However, it doesn't seem to work if the current page, i.e. the page on which the link is present, has a complicated URL. The situation is this: sometimes we need access to our intranet pages from a remote work site. We currently have a temporary solution until we get a real VPN. The sysadmin has some kind of Cisco "VPN" router like a proxy which allows us to log in over https and get access to the intranet. However, the current page URLs are displayed in the browser with a prefix added on by this device, which is probably what is causing the trouble. 

If the normal URL is "http://www.mydomain.com/mydir/mypage.html", then the URL used over the erstwhile "VPN" is:
https://vpn.mycompany.com/https/0/www.mydomain.com/mydir/mypage.html

In the status bar, the links to local files are shown normally. However, the links to local files are ignored when I click on them even though I have added the following entry to user.js:

user_pref("capability.policy.localfilelinks.sites", "https://vpn.mycompany.com");

So depending on whether the page is being served normally within the intranet or over the "VPN", the entry in user.js works or not.

I'm suspecting that there is some string parsing somewhere which gets confused by the https "directory" or the additional domain in the URL. 

Perhaps this behavior is deliberate in order to address some security concern about maliciously constructed URLs, but if not, then this needs to be looked at. Even if it is deliberate, this may be an unintended side-effect.




Reproducible: Always

Steps to Reproduce:
1. You gotta have one of these stupid Cisco things, I guess.
2.
3.

Comment 1

[Uriah Narmed]

If you have two user_pref() entries that both set capability.policy.localfilelinks.sites, the second will override the first. In order to specify more than one site, you need to add all of them separated by spaces in a single user_pref() entry, e.g.:

user_pref("capability.policy.localfilelinks.sites", "https://www.example.com https://vpn.example.com");

Comment 2

[Scott Pedigo]

I changed the entry in user.js as suggested in Comment #1 to put all the domains in a single entry and now everything works. The bug can be marked INVALID or otherwise closed. Thanks for the quick response.