Firefox addons/extensions should place their temporary files only under the profile directory

RESOLVED INVALID

Status

()

Firefox
Untriaged
RESOLVED INVALID
5 years ago
5 years ago

People

(Reporter: t8av, Unassigned)

Tracking

22 Branch
x86
Windows 7
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
User Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:

I was trying to use the MAF extension:

1. Saved a web page as .MAFF
2. Viewed the saved page in Firefox.
3. Viewed and image in the MAFF file and checked its location.





Actual results:

I found that firefox is storing the temporary files of the MAF extension in:

C:\Users\user\AppData\Local\Temp\maftemp....



Expected results:

Any firefox temporary files must be created only under the profile location which was defined by the user (which can be located in another disk).

Using other locations can be a security problem.
(Reporter)

Comment 1

5 years ago
Please add Paolo Amadini to this bug's CC list.

I cannot understand his Email address which is defined in:

http://maf.mozdev.org/feedback.html

Comment 2

5 years ago
That we save downloads in the temporary directory is well-known, and not considered a security hazard.
Group: core-security
(Reporter)

Comment 3

5 years ago
(In reply to Benjamin Smedberg  [:bsmedberg] from comment #2)
> That we save downloads in the temporary directory is well-known, and not
> considered a security hazard.

Firefox surely needs a directory location for its temporary files, however once the user defined a profile directory, Firefox must use only this location, and not other locations. The user does not expect to find files in other locations.

Comment 4

5 years ago
(In reply to t8av from comment #3)
> (In reply to Benjamin Smedberg  [:bsmedberg] from comment #2)
> > That we save downloads in the temporary directory is well-known, and not
> > considered a security hazard.
> 
> Firefox surely needs a directory location for its temporary files, however
> once the user defined a profile directory, Firefox must use only this
> location, and not other locations. The user does not expect to find files in
> other locations.

It is standard practice for many/most windows applications to put temp files in standard "OS defined" temp directory locations.  I for one do not want these files in my profile - I don't want them backed up with other firefox data, etc.

This is working as designed and I'm quite sure it will not be changed.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.