353545 - FTP page may bypass proxy specified in .pac file at browser startup

Status: RESOLVED WONTFIX

(Core Graveyard :: Networking: FTP, defect)

Description

[Ton [:Tonnes]]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1) Gecko/20060920 BonEcho/2.0
Build Identifier: 

When FF starts up with 4 recent tabs in which 3 similar ftp sites are opened and a .pac file is used, it may try to connect to one of them over a direct connection, bypassing the proxy.

Reproducible: Sometimes

Steps to Reproduce:
1. Open a random website in one tab, any ftp site in the second, 3rd and 4th
2. Close FF using 'Show my windows and tabs from last time'
3. Configure the firewall or any other network software to show the ip and ports used when connecting, or prohibit FF to use port 21
4. Start Firefox

Actual Results:  
Traffic/firewall logger shows port 21 and direct ip are used in one case (often the 2nd or 3rd tab) while all others use the proxy, or one tab (for ftp) gets a network reset message if port 21 connections are not allowed.

Expected Results:  
All tabs should use the proxy specified in the pac file in all cases.

This seems to be happening most of the time, only for ftp and when using a pac file. Both http (+pac) as well as ftp + using the pac's proxy in FF's preferences give no trouble.

Comment 1

[timeless]

i'm declassifying this. thank you for the report, i'm sorry mozilla isn't perfect, hopefully someone will address this report. there is nothing security sensitive in this report.  

Comment 2

[Ton [:Tonnes]]

Indeed, not a security issue. Just filed it as such, just in case.

The problem still occurs in the current 1.9.2 branch (1.9.9.2pre, 20100223). Changing title, version and OS, but presumably valid for all OS’es.

Comment 3

[Patrick McManus [:mcmanus]]

We are in a period where ftp is clearly deprecated and in general, making changes to the code is riskier than letting it ride unless there is a patch and reviewer available to make a good judgment about it. So I'm going to wontfix ftp bugs related to enhancements, interop errors, etc.. We will be better off putting our energy into including a different js based ftp stack.