362248 - save uncachable (and ssl served) content as readable only by user (unix:0600, win: acl:user:all)

Status: NEW

(Firefox :: File Handling, enhancement)

Description

[timeless]

Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.8.0.6) Gecko/20060911 Firefox/1.5.0.6

"shaver made me file this"

shebs: don't see how a browser can guess that the umask is set too broadly for a "more-sensitive" file
crowder: shebs: That doesn't mean that the browser couldn't save "sensitive" content with a more restrictive default permissions set. At that point, who cares what umask is
shaver: but saving SSL-loaded content as the platform equiv of 600 would seem reasonable, if the information is available
crowder: Yeah, that's kind of a nice feature in fact
shaver: shebs: we could detect that the content is set to not be cacheable; which would catch SSL and other such things

steps:
1. load the super secret page (from your bank) with your bank statement,
since I don't have your bank statement's url, let's pretend:
https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&format=guided
is super secret
2. file>save
3. click save

if you're on unix like i am, it's /possible/ that you just saved your file to /tmp (not sure why it's /tmp, maybe that's the last place i saved a less than confidential file).

expected results:
only i should be able to read the file, not other users

how: using unix file mode permissions or acls where available (windows/nfs/zfs)