Closed Bug 1757643 Opened 2 years ago Closed 2 years ago

Windows reserved filenames can be used for downloaded files

Categories

(Firefox :: File Handling, defect, P3)

Product:
Firefox
Component:
File Handling
Version:
Firefox 99
Platform:
Desktop
Windows
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
102 Branch
Tracking Flags:
Tracking Status
firefox102 --- fixed

People

(Reporter: bjornson, Assigned: enndeakin)

References

Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Steps to reproduce:

Clicking this link in Firefox will save a file named COM1:

<a href="data:,Hello%2C%20World%21" download="COM1">download COM1</a>

That's one of the names reserved by Windows, however: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file#file-and-directory-names

All of the other reserved names (CON, PRN, AUX, COM1-9, LPT1-9) except for NUL save. NUL fails to download. Chromium sanitizes these to names like "_COM1.txt".

(I don't know if this actually has to be fixed. There doesn't seem to be a security issue and the user can manually rename the files.)

The Bugbug bot thinks this bug should belong to the 'Firefox::File Handling' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Component: Untriaged → File Handling

I believe Neil's patches in bug 1746052 address this.

Severity: -- → S3
Depends on: 1746052
Priority: -- → P3

We appear to now overwrite this on nightly after bug 1746052

Assignee: nobody → enndeakin
Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
status-firefox102: --- → fixed
OS: Unspecified → Windows
Hardware: Unspecified → Desktop
Resolution: --- → FIXED
Target Milestone: --- → 102 Branch
You need to log in before you can comment on or make changes to this bug.