436226 - Description of default Windows handler for images is ugly/confusing on Vista

Status: RESOLVED WONTFIX

(Firefox :: File Handling, defect)

Description

[Sam Vilain]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-GB; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Build Identifier: Firefox 2.0.0.14 for Windows on Windows Vista

This may be a security vulnerability.  I have a screenshot of Firefox 2.0.0.14 on Vista trying to open up an image with a dangerous handler, that could allow embedding of trojans into images.

Reproducible: Always

Steps to Reproduce:
1. Search for "understanding art for geeks" in google
2. Find the link to kpchen.blogspot.com
3. Follow the top link to the full-sized image
Actual Results:  
 http://utsl.gen.nz/failfox-keepn-yoo-safe.png

Expected Results:  
view the image

Comment 1

[Sam Vilain]

Note: please take the annotations in the image as a light-hearted joke.  I have no idea whether the true culprit is Vista or Firefox, more likely a shoddy API.

Comment 2

[Bob Clary [:bc] (inactive)]

XPSP2: 
 
Firefox 2.0.0.14: Open with Windows Picture and Fax Viewer
Firefox 3.0rc1  : Save File

Vista: 

Firefox 2.0.0.14: Open with Windows Host Process 
Firefox 3.0rc1  : Open with Windows Photo Gallery


  HTTP/1.0 200 OK
  ETag: "1140"
  Expires: Fri, 30 May 2008 05:53:20 GMT
  Cache-Control: max-age=86400
  Content-Type: image/jpeg
  Content-Disposition: attachment
  Date: Thu, 29 May 2008 05:53:20 GMT
  Server: fife
  Connection: Keep-Alive
  Keep-Alive: timeout=3
  Content-Length: 19506
  Length: 19506 (19K) [image/jpeg]

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Why do you think it's a dangerous handler? I think it's just a problem with the way we get the app description in 2.0.0.x - IIRC Windows Picture and Fax viewer is actually opened using rundll32.exe by default on Windows.

Comment 4

[Jim Mathies [:jimm]]

>I think it's just a problem with the
>way we get the app description in 2.0.0.x...

Yep. Rundll is used in both, we now obfuscate the "real" handler in 3.0 for better usability.

A lot of built-in 3rd party apps in vista and xp use rundll, it's a pretty standard way of doing things these days for microsoft. I'd say the new 3.0 handling is more secure since you actually see what handler your going to hand the file off to.

Comment 5

[Jim Mathies [:jimm]]

One question though, why didn't Fx2 just display the jpeg?

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Because of the Content-Disposition: attachment (see comment 2).

Not a security sensitive bug, then. Jim, do you think porting the better handler name retrieval to the branch is feasible?

Comment 7

[Jim Mathies [:jimm]]

>Jim, do you think porting the better handler name retrieval to the
>branch is feasible?

I can't recommend that honestly. The handler code has changed quite a bit over the last year so we'd have to do a lot of work and testing. I'm not sure how portable the new code is really. With Fx3 right around the corner and a lot of work to do ahead of us I think it would be sort of a waste of valuable time. That's a judgement call on my part though. I guess it depends on how much weight we put on backporting stuff like this to older versions, which is something I don't have a good feel for. 

Comment 8

[:Gavin Sharp [email: [e-mail]]]

Alright, that makes sense. I guess we can call this FIXED, then, since it's dealt with in Firefox 3. I'm not sure what to make of Bob's XP results - seems like we should be still offering to open there (and did in Firefox 2). Different bug, perhaps?

I'll let branch drivers evaluate the wanted1.8.1.x request, but I don't have any reason to oppose wanted- given comment 7.

Comment 9

[Sam Vilain]

Ok, sorry for the false alarm.  I don't use Windows much :)

Perhaps it's worth just special casing this known special handler to make it a less frightening-looking option to select?

Comment 10

[Daniel Veditz [:dveditz]]

Confirming bug, it is indeed ugly and scary looking in Firefox 2.0.0.x.