Closed Bug 1741929 Opened 3 years ago Closed 3 years ago

Downloaded file no longer deletes automatically when quitting / exiting the browser (with download improvements turned on)

Categories

(Firefox :: Downloads Panel, defect)

Firefox 96
Desktop
Windows 10
defect

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox-esr91 --- unaffected
firefox94 --- unaffected
firefox95 --- unaffected
firefox96 --- wontfix

People

(Reporter: alice0775, Unassigned)

References

Details

(Keywords: nightly-community, regression, Whiteboard: [fidefe-mr11-downloads])

[Tracking Requested - why for this release]: Data would not be sanitized, data leak.

Steps to Reproduce:

  1. Change "Use Windows default application" for PDF in about:preferences

  2. Open http://www.africau.edu/images/default/sample.pdf
    --- The "Windows default application" for PDF will open as expected.

  3. Quit the associated Windows default application

  4. Quit Browser

  5. Observe, the downloaded file

Actual Results:
The the downloaded file would not be deleted

Expected Results:
The the downloaded file should be automatically deleted.
Browser should honer setting of "browser.helperApps.deleteTempFileOnExit"(default true)

Blocks: 1733587

This behaviour comes from a change made in Bug 1710933: https://searchfox.org/mozilla-central/rev/bc5e79f3ae0f42cb4a6ebd05fc32f48a3829059d/toolkit/components/downloads/DownloadCore.jsm#607-615. Since we're not downloading externally handled files to the tmp/ directory anymore, we don't delete these files when the browser session is closed.

We may still honor "browser.helperApps.deleteTempFileOnExit" if we also check if the file is a temporary download in Download._succeed. A similar check is done here. But again, since we're not downloading to the tmp/ directory, it doesn't make sense that we should do be doing this check just because it's set to true.

We can remove this preference to avoid confusion and perhaps we can expose data on a download that indicates it was opened automatically (see Gijs' comment in https://bugzilla.mozilla.org/show_bug.cgi?id=1738574#c3).

Whiteboard: [fidefe-mr11-downloads]

This isn't a security issue. It's also not a data leak - your downloads folder isn't really more or less likely to be visible to anyone but yourself, and deleting the files from the tmp folder also isn't/wasn't 100% reliable (esp. if the application opening the file kept it open while Firefox exited/quit). We still delete files opened (rather than downloaded) in private browsing, I believe.

It also doesn't really make sense to track for 96 - we no longer think these changes will ship with 96, it looks more likely to be 97 now (but we can't easily track for future releases.

However, either way what we do here is a product management decision, and I'd like to suggest we stop tracking it for that reason - Dianna, is that OK?

Flags: needinfo?(dsmith)
Keywords: sec-low
Summary: Downloaded file would not delete automatically when quit browser → Downloaded file no longer deletes automatically when quitting / exiting the browser (with download improvements turned on)
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WONTFIX
Flags: needinfo?(dsmith)
You need to log in before you can comment on or make changes to this bug.