712335 - Privacy leak in Windows file picker dialogs when selecting a URL in the open file field

Status: NEW

(Core :: Widget: Win32, defect)

Description

[Jim Mathies [:jimm]]

STR:

1) open a file picker
2) copy paste a url to a file on the web in the file name text edit
3) select ok

Windows will go out a download the file and place it in the IE cache, then return a local path to the file. The remains until the IE cache is cleared.

Comment 1

[Jim Mathies [:jimm]]

Attachment: test case

Comment 2

[Masatoshi Kimura [:emk]]

It really leaks? Is it possible to read the full path from the web page?

Comment 3

[Jim Mathies [:jimm]]

(In reply to Masatoshi Kimura [:emk] from comment #2)
> It really leaks? Is it possible to read the full path from the web page?

I don't think we expose local paths to web pages, but the file definitely sticks around after we shut down when running in privacy mode.

Comment 4

[Rain [:rain1] (inactive)]

Does Chrome have the same issue?

Comment 5

[Brian R. Bondy [:bbondy]]

Since the file is stored in the user's application data I personally don't think this is too big of a deal.  

If the user is an admin then they will have access to all files anyway.  If the user is a limited user account they will not have access to the file. 

Maybe this is more related to private browsing or something though?