394824 - scripts can automatically submit file uploads selected by the user

Status: RESOLVED WONTFIX

(Firefox :: Security, enhancement)

Description

[Alex Rickabaugh]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.4) Gecko/20070629 Firefox/2.0.0.4
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.4) Gecko/20070629 Firefox/2.0.0.4

The gmail web application automatically uploads attachments selected in the background, so users can continue to compose their mail while the file uploads. Essentially, immediately after the user selects a file by clicking on the "Browse" button of a file <input> field, the script can begin uploading the file.

This could be a security problem if the user accidentally selects the wrong file (ex: confidential banking information, etc) and the script has the authority to commit the upload automatically.

I propose that form submissions involving file uploads that are triggered automatically (via javascript) offer the user a warning dialog box. Perhaps something like "The site http://www.gmail.com is attempting to automatically upload the file 'mybankinfo.doc'. Should gmail.com be allowed to upload this file?" with Yes and No options. This way, a user who made a mistake and selected the wrong file has an opportunity to correct the situation and select the right file before allowing the upload to proceed.

Reproducible: Always

Steps to Reproduce:
Using gmail example:

1. Compose new message.
2. Attach a file.
3. Wait as gmail uploads the file.
Actual Results:  
The file is uploaded (silently).

Expected Results:  
My browser should confirm with me that I intended to upload this file before it allows the script to trigger the upload. On the other hand, if I purposefully submit the form by clicking a submit button on the page, I'm responsible for authorizing the upload and the browser need not confirm it a second time.

This could be made into a security setting so that users who were annoyed by the extra step to confirm an automatic upload could turn the feature off.

Comment 1

[Jesse Ruderman]

Firefox can't distinguish between a click on the "Browse..." button and a click on a submit button, so this warning would end up appearing on legitimate sites like Gmail but not on attack sites.  That would be kinda silly :)

Fixing this would also break the "preview" feature on some times that we're trying to allow with bug 371432.

If you select the wrong file on Gmail, just click the "remove" link next to it and it won't be sent to the recipient of your message.

Are you using a weird file picker that makes it really easy to select the wrong file or something?

Comment 2

[Alex Rickabaugh]

Gmail was an example of an application that employed the automatic upload functionality. A more malicious application could capture user files and save them, not providing the "remove" link that gmail allows.

This bug report is based on one observation: a 'normal' user would expect no form information to be submitted until he or she clicks the submit button to the form. 

Thinking through this, the problem holds true for regular forms as well as file submissions: if I accidentally paste information into a text box, it becomes accessible by the remote website, either via automatic form submission or XMLHttpRequest.

Is this considered an "acceptable" outcome, then?

Comment 3

[Jesse Ruderman]

> Is this considered an "acceptable" outcome, then?

I think so.

Comment 4

[Daniel Veditz [:dveditz]]

Note that this behavior is true of all the other browsers too, it's baked into the specs (if scripts are enabled). Either you trust the web site with your information or you don't. If you don't, don't enter any information in the first place. If you do and the trust is misplaced they could always wait until you submit the form to abuse your data -- in fact that's more likely because then they know they've gotten the best version of the data.