348763 - treat .application files like .exe files

Status: RESOLVED FIXED

(Toolkit :: Downloads API, defect)

Description

[u49640]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1

a .application file is a link to a potentially unsafe (Dotnet) Applicaton.

Right now Firefox has the option to open them with the default location. Since those .application files can basically execute an arbitrary binary, this should be handled like a .exe file and disallow direct opening.

But Windows will at least show a warning like this
http://www.ondotnet.com/dotnet/2004/10/11/graphics/image008.jpg
to inform the user that this is an (untrusted) app.

(Marking this bug as security-bug, but i'm not sure if this is correct)

Reproducible: Always

Comment 1

[Daniel Veditz [:dveditz]]

It won't show that warning if it's signed, and borderline legit adware companies can easily get certs (until they clearly step over the line the lawyers are afraid of getting sued if they deny the cert).

Would be easy to fix by adding to the list at http://lxr.mozilla.org/mozilla/source/xpcom/io/nsLocalFileWin.cpp#2355

Doug: what do you think? I'm happy to shepherd this in if we agree this is reasonable.

Comment 2

[u49640]

btw: while we are at determine dangerous files: wouldn't it be a good idea to use the List from Microsoft's Outlook 2003 to determine which files are dangerous and shouldn't be executeable?

http://office.microsoft.com/en-us/assistance/HA011402971033.aspx

Comment 3

[Mike Connor [:mconnor]]

I think its reasonable to follow the same list as Outlook, with anything additional we already block.  dveditz, do you have cycles for doing this?

Comment 4

[Daniel Veditz [:dveditz]]

Attachment: sync with Outlook's blocked files

This syncs our list of executables with the Outlook list of blocked extensions. I'm not sure that's really right, though, we not quite blocking things for the same reason or in the same way. (I used the list from Outlook 2007 rather than 2003, the same plus .msh, .mshxml, and .plg).

I couldn't find any documentation that mentions a .application extension. In some ways our "IsExecutable" check misses the boat entirely. Extensions are important for matching non-executables with their default handler, but actual executables are run because they are in fact executable, regardless of extension. You can rename firefox.exe to xxx.xxx and it will run just fine.

Comment 5

[Daniel Veditz [:dveditz]]

I don't think we need to mess with this for 1.8.0.7, moving back to nominated state for re-triage.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Dan, can you land this on trunk so we can see it shake out? Looks safe enough to take for 2.0, but kinda confused as to why it's not yet on trunk.

Comment 7

[Mike Schroepfer]

DVeditz - ping.  We are getting close to/past our trunk bake window.  So this will get pulled off the FF2 list shortly...

Comment 8

[Mike Schroepfer]

we don't have enough time for testing this fix - so I'm taking it off the ff2 blocker list.

Comment 9

[Daniel Veditz [:dveditz]]

Restoring lost blocking flag

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

Dan's promised to get this on the trunk - he thinks he might have done so already!

Comment 11

[Daniel Veditz [:dveditz]]

Checked in on trunk

Comment 12

[Jay Patel [:jay]]

Comment on attachment 235704 [details] [diff] [review]
sync with Outlook's blocked files

Approved for both branches, a=jay for drivers.

Comment 13

[Daniel Veditz [:dveditz]]

Fix checked into 1.8 and 1.8.0 branches