642333 - Firefox renames files with a ZIP extension if MIME type is set to application/zip

Status: RESOLVED WONTFIX

(Core Graveyard :: File Handling, defect)

Description

[Ryan]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15

Firefox renames files by adding a ".zip" file extension when the MIME type of the download is set to "application/zip". 

Reproducible: Always

Steps to Reproduce:
1. On server (IIS), set MIME type for a file type, e.g. EXE, to "application/zip".
2. On client (Firefox), download the file.

Actual Results:  
File is renamed with added ".zip" file extension.

Expected Results:  
File should be downloaded as per its name on the server. 

Tested with IIS7 and EXE files. EXE files were downloaded as "file.exe.zip". 

Changing MIME type for downloads is a work around for problems in Internet Explorer. i.e. See the following link:

http://cynic.me/2011/03/07/internet-explorer-download-problem-unable-to-open-this-internet-site/

That details the issue with Internet Explorer and how changing the MIME type works to resolve it. 

However, the fix for that reveals an issue with Firefox renaming files according to MIME type. 

ZIP is a common container format for different formats, e.g. DOCX, XSLX, PPTX, and many game file formats and skin formats use ZIP as well.

Comment 1

[Matthias Versen [:Matti]]

>2. On client (Firefox), download the file.

How ?
right click on a link to the file and "saver as", open the link and save it to disk or open the link and open it with a helper application ?

Comment 2

[Ryan]

Clarification for #2:

<meta http-equiv="Refresh" content="5; url=http://www.domain.com/file.exe"/>

Comment 3

[Ryan]

Here's a work around in C# (ASP.NET) that addresses the IE issue and the Firefox issue:

System.Web.HttpBrowserCapabilities browser = Request.Browser;
if (browser.Browser.ToLower() == "ie")
{
// If the browser is Internet Explorer, use the ZIP MIME type:
Response.ContentType = "application/zip";  
}
else
{
// Firefox saves an "application/zip" with a .zip file extension,
// so make the MIME type an octet stream:
Response.ContentType = "application/octet-stream";
}

Comment 4

[Matthias Versen [:Matti]]

I think this report is invalid. Changing the extension is a security feature. You can either use the user agent sniffing or use a unused content type like application/x-ms-download.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yep.  On Windows, if the filename has a "dangerous" extension, we make sure the extension matches the type it was served with.  Anything else would be really bad security-wise.

Comment 7

[Rebeccah]

This is really annoying.  Granted, it's been a long time since I've upgraded FF, but it didn't used to behave this way.  When I download a jar file, no matter what I specify for a filename and file type in the "save link as" file chooser dialog, FF appends  .jar.zip to the end.

So, the filename chooser dialog is basically useless.

I understand this is a security feature, but it ought to be possible for the user to disable it so that one can specify the filename one wants the downloaded file to have.  BTW, the .jar extension already specifies that this is a compressed file.  Who decided that all compressed files have to have a .zip file extension?