976266 - infinite loop specifying Firefox as the helper app for a type/protocol Firefox doesn't handle (e.g. telnet:)

Status: RESOLVED DUPLICATE of bug 1496380

(Firefox :: File Handling, defect)

Description

[Mario San Juan]

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36

Steps to reproduce:

I wanted to open a telnet address and choose which application to launch, and suddenly firefox chose many tabs opened P.S serves to address any telnet


Actual results:

Many tabs opened and the browser stopped working


Expected results:

They wanted to open a link that had shown correctly, P.S excuse the mistakes what happens is that I use google translator

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Please visit support.mozilla.org for help with your issue. If there is a bug
that needs attention from a developer, they can help you to file a good bug
report (steps to reproduce, better symptoms, etc).

Comment 2

[Mario San Juan]

Attachment: Here I leave the video to see if is a fault

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 8380958 [details]
Here I leave the video to see if is a fault

The attachment is just the text of the following URL (and isn't a link)
http://www.youtube.com/watch?v=ye7YLIOeuJA&feature=youtu.be

Comment 5

[Daniel Veditz [:dveditz]]

Firefox does not know how to handle the telnet: protocol and when you encounter a protocol or content-type Firefox doesn't know how to handle it asks if you want to use an external program to open the file. If you specify Firefox itself as the handler then when the operating system hands the link to Firefox the browser still doesn't know how to handle this type so it looks for an external handler again. If you check the box so it never asks before doing the action you've then set up an infinite loop. fwiw I don't recommend checking that box: in the benign case it's just an extra click to open up an attachment, and in the malicious case you might have the chance to avoid getting infected if sites suddenly start trying to give you files you weren't expecting because they just found a new zero-day in Word or something.

This infinite loop is self-inflicted so it's not a security vulnerability that can be used to attack others. The obvious solution is to not let users specify Firefox as the handler for types Firefox doesn't know how to handle, but we share some of that UI with the case of sites using the content-disposition header to force a download of a type Firefox _does_ know how to handle so that might be annoying. The next solution that comes to mind is to ignore the "don't ask me" option on helper apps for URLs that were themselves loaded from the command-line.

Hopefully most people who know enough to have gotten themselves into such a loop would also know how to kill the runaway Firefox process in the task manager. I doubt this happens enough in practice to be prioritized over fixing other bugs.

I recall people pointing this out before, we probably already have a bug on this.

Comment 7

[:Gijs (he/him)]

This was fixed on the nightly branch on Windows and Mac in bug 1496380.