685853 - firefox file://... opens the wrong file when there's a firefox running on a different machine

Status: UNCONFIRMED

(Core :: Networking: File, defect, P5)

Description

[Vincent Lefevre]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2 Iceweasel/6.0.2
Build ID: 20110906070925

Steps to reproduce:

1. Run firefox on the local machine A.
2. Connect to a remote machine B.
3. Run "firefox file:///path/to/file" or "firefox file://host_B/path/to/file".


Actual results:

/path/to/file from machine A is opened (if it exists).


Expected results:

/path/to/file from machine B should be opened or Firefox should display a clear message saying that this is not implemented.

Comment 1

[Vincent Lefevre]

Raising to major as this can be a security problem (e.g. a file with sensitive information could be displayed, perhaps other unknown consequences...). Local files should be opened only at an explicit user request.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I'm 99.99% sure that there's an existing bug on file:// URIs not supporting hostnames in necko...

Comment 3

[Vincent Lefevre]

There's bug 70871, but it is different. Bug 70871 is about accessing remote file://host/ URL's, while this bug is about accessing file:// URL's, where the host part is empty or localhost and any other hostname of the local machine (i.e. the machine from which the command is invoked).

This bug can be partly seen as a consequence of bug 70871 due to the fact that the invoked firefox connect to a remote firefox. But this bug might also be fixed without fixing bug 70871 (e.g. by avoiding the connection to the other running firefox).

Comment 4

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.