739050 - Firefox update removes user list of pages with blocked images

Status: UNCONFIRMED

(Firefox :: Security, defect)

Description

[Roeland]

STEPS: launch Firefox (start with one version older than 11.0 for Ubuntu or XP: it will be updated later in this step list) --> 'Edit' --> 'Preferences' --> 'Content' --> 'Load images automatically': on --> 'Exceptions...' --> set a website with virus in image --> 'Allow'; eventually add www.google.be also to the list --> close --> update that Firefox to 11.0 --> Launch Firefox 11.0 --> check the list with blocked images again.
PROBLEM: the list with the blocked image pages is removed and the images are NOT blocked any more.

In my common use, I block the picture of www.google.be to load my start page faster but I had to add that page again in Firefox to block it's picture(s) after an update of Firefox.

AWARD INFO: I consider this safety issue important enough to earn an award of more than 500 $ (US). 1000 $ (US) seems to be a fair award to agree.

Comment 1

[Daniel Veditz [:dveditz]]

I assume you meant to set "Block" rather than "Allow" in the steps above? I could not reproduce this in a quick test--my image blocking sites were preserved--although I did use Mac rather than Ubuntu or WinXP.

Were all of your other settings preserved, such as bookmarks or history? We have occasionally seen people run into a bug where the old "profile" is in use so the upgrade creates a new one with default settings.

A similar problem could happen on a more limited scale if only the permissions database was locked or corrupted. If that were the case you would also lose settings for blocking cookies from particular sites (not cookies themselves).

This bug does not qualify for the security bug bounty. Image blocking is not a security feature because it is unreasonable to expect users to know where malicious images are going to come from ahead of time and block them. If Firefox is vulnerable to a virus-laden image then -that- is the security bug. The image blocking feature is primarily for performance reasons for those on limited bandwidth.

Comment 2

[Roeland]

Dear,

I made a mistake: I mean "Block" instead of "Allow"...
I kept my bookmarks after the update of Firefox. I don't know if my history was kept too.
;-)

Regards,

Comment 3

[Virgil Dicu [:virgil] [QA]]

Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20120411 Firefox/14.0a1

I can't reproduce either while manually updating to the latest Nightly.