Closed Bug 400222 Opened 14 years ago Closed 13 years ago

"Application" content type in Applications prefpane has problems

Categories

(Firefox :: File Handling, defect, P3)

x86
Windows XP
defect

Tracking

()

RESOLVED FIXED

People

(Reporter: bugzilla, Assigned: florian)

References

Details

Attachments

(1 file, 2 obsolete files)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; da; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007101704 Minefield/3.0a9pre

Options dialog, Applications tab.

Current options for the "Application" entry in the list of content types and protocols are:

* Always ask
* Choose application...
* Save File

"Choose application" option should be removed. It doesn't make sense to open an application with another application.

"Save File" option should also be removed because we would always like to ask the user first for this file type, for security reasons.

Since there is only one option left, it might make sense just to remove the entry from the list.

Reproducible: Always
Version: unspecified → Trunk
Not sure whether this is a blocker or not; nominating.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking-firefox3?
(In reply to comment #0)
> 
> "Choose application" option should be removed. It doesn't make sense to open an
> application with another application.

What about Resource Hacker, Dependency Walker and other applications that open .exe files? I agree that it's not the common case though.
 
> "Save File" option should also be removed because we would always like to ask
> the user first for this file type, for security reasons.

Not sure it would be a good idea to always popup a warning when an application is downloaded. I think such a warning would be kinda annoying.
(In reply to comment #2)
> What about Resource Hacker, Dependency Walker and other applications that open
> .exe files? I agree that it's not the common case though.

I think _always_ opening .exe files like that is extremely uncommon.

> Not sure it would be a good idea to always popup a warning when an application
> is downloaded. I think such a warning would be kinda annoying.

Firefox 2 already does that.
I think we should special case all the things which we already special case to "always ask" and just omit them from this listing.

If users want to open them in another application as Florian proposes, they can do that from those applications. Our default here should be security, preventing .exe files from auto-running.
Flags: blocking-firefox3? → blocking-firefox3+
Priority: -- → P3
Assignee: nobody → florian
I looked at this more closely.  I think the bug is not in the pref window but that the "Applications" type should simply never be added to the mime type preferences.

Apparently adding it is intentional though, there's a comment in the code saying:

"We do not store anything in the mime type preferences for the ambiguous type application/octet-stream. We do NOT do this for application/x-msdownload since we want users to be able to autodownload these to disk."

http://mxr.mozilla.org/seamonkey/source/toolkit/mozapps/downloads/src/nsHelperAppDlg.js.in#897
Ok, so what we need to decide here is if we want to special case the application/x-msdownload type so that it is never added to the list or if we only want to remove the "Choose Application..." item for "Application" type.
Keywords: uiwanted
Whiteboard: [needs ui-decision, patch]
Since the default action for an application is to save to disk, something that is not risky in and of itself, forcing a dialog saying "do you really want to save this?" seems more annoying than helpful. 

I'll assert that we should special case application as "save to disk; never ask", and omit it from that listing.
Attached patch patch v1 (obsolete) — Splinter Review
Ok, opening automatically an application with another application would be silly. This patch removes this menuitem.

As I said in comment 5, there was already a special case in the code to allow users to save automatically applications.  I think that for security reasons it's good to keep the warning on by default (so I kinda disagree with comment 7 which said that we should special case to always save, never ask) but I really don't see why we would prevent advanced users from getting rid of this annoying warning from the pref window.

Btw, the risk with downloading automatically an application is that the user can then launch it by mistake.  Users who will find how to get rid of the warning from the pref window probably already know what an application is and how to find out if a file is an application or not, so they don't need this warning which will just cause warning fatigue for them.
Attachment #294806 - Flags: ui-review?(beltzner)
Attachment #294806 - Flags: review?(gavin.sharp)
Keywords: uiwanted
Whiteboard: [needs ui-decision, patch] → [needs ui-r beltzner, r gavin]
Attachment #294806 - Flags: ui-review?(beltzner) → ui-review+
Whiteboard: [needs ui-r beltzner, r gavin] → [needs review gavin]
Attached patch patch v2 (alternative version) (obsolete) — Splinter Review
The MIME type of executable files is obtained from the MIME service instead of being hard coded.
Attachment #296046 - Flags: review?(gavin.sharp)
Perhaps this is a stupid question, but how does one get an entry for the "application" type to begin with? Does it require a profile from some old version of Firefox, or something?
(In reply to comment #10)
> Perhaps this is a stupid question, but how does one get an entry for the
> "application" type to begin with? Does it require a profile from some old
> version of Firefox, or something?
> 

I don't know how it got there, but it is not from an old version of Firefox. I created my profile around 6 months ago and have only used it on trunk.
(In reply to comment #10)
> how does one get an entry for the "application" type to begin with?

This entry is added the first time a .exe file is downloaded and saved.
The code that adds it is more or less what I linked to in comment 5.

> Does it require a profile from some old version of Firefox, or something?

No.
(In reply to comment #12)
> (In reply to comment #10)
> > how does one get an entry for the "application" type to begin with?
> 
> This entry is added the first time a .exe file is downloaded and saved.
> The code that adds it is more or less what I linked to in comment 5.

Ah, somehow my testcase (downloading http://people.mozilla.org/~gavin/ScanTest/ScanTest.exe ) didn't create such an entry. The entry was added when I File->Opened that file and saved it again.
Comment on attachment 296046 [details] [diff] [review]
patch v2 (alternative version)

r=me, but put the declaration/initialization of executableType right next to the (handlerInfo.type != executableType) check, in the same ifdef, rather than separating them like that.
Attachment #296046 - Flags: review?(gavin.sharp) → review+
Attachment #294806 - Attachment is obsolete: true
Attachment #294806 - Flags: review?(gavin.sharp)
(In reply to comment #14)
> (From update of attachment 296046 [details] [diff] [review])
> put the declaration/initialization of executableType right next to
> the (handlerInfo.type != executableType) check, in the same ifdef, rather than
> separating them like that.
> 

hmm. Do you really want to execute:
 var executableType = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService).getTypeFromExtension("exe");
once for each row of the Applications tab?
Err... I misread the code, sorry.
Checking in browser/components/preferences/applications.js;
/cvsroot/mozilla/browser/components/preferences/applications.js,v  <--  applications.js
new revision: 1.33; previous revision: 1.32
done
Attachment #296046 - Attachment is obsolete: true
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: [needs review gavin]
You need to log in before you can comment on or make changes to this bug.