892891 - Firefox addons/extensions should place their temporary files only under the profile directory

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[t8av]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:

I was trying to use the MAF extension:

1. Saved a web page as .MAFF
2. Viewed the saved page in Firefox.
3. Viewed and image in the MAFF file and checked its location.





Actual results:

I found that firefox is storing the temporary files of the MAF extension in:

C:\Users\user\AppData\Local\Temp\maftemp....



Expected results:

Any firefox temporary files must be created only under the profile location which was defined by the user (which can be located in another disk).

Using other locations can be a security problem.

Comment 1

[t8av]

Please add Paolo Amadini to this bug's CC list.

I cannot understand his Email address which is defined in:

http://maf.mozdev.org/feedback.html

Comment 2

[Benjamin Smedberg]

That we save downloads in the temporary directory is well-known, and not considered a security hazard.

Comment 3

[t8av]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #2)
> That we save downloads in the temporary directory is well-known, and not
> considered a security hazard.

Firefox surely needs a directory location for its temporary files, however once the user defined a profile directory, Firefox must use only this location, and not other locations. The user does not expect to find files in other locations.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to t8av from comment #3)
> (In reply to Benjamin Smedberg  [:bsmedberg] from comment #2)
> > That we save downloads in the temporary directory is well-known, and not
> > considered a security hazard.
> 
> Firefox surely needs a directory location for its temporary files, however
> once the user defined a profile directory, Firefox must use only this
> location, and not other locations. The user does not expect to find files in
> other locations.

It is standard practice for many/most windows applications to put temp files in standard "OS defined" temp directory locations.  I for one do not want these files in my profile - I don't want them backed up with other firefox data, etc.

This is working as designed and I'm quite sure it will not be changed.