From 1283a5f874306ab56b61a2036466a6ef0714d771 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 2 Apr 2025 14:31:19 +0200
Subject: [PATCH] [widget] Extend the use of FOS_NODEREFERENCELINKS on Windows.

In the modern era of user-customizable Quick Access sidebars on every file
dialog, navigating via `.lnk` files is considerably less useful than it
was twenty years ago.

Disable link-following in file-open dialogs by default, to prevent any of
the usual security issues involving symlink smuggling.

Allow overriding this behavior via a pref, for users who want to trade off
this security issue for convenience of being able to follow links inside
file dialogs (older OSes and established user workflows).
Note: File Save dialogs have a set of more nuanced guards against link
smuggling and protected file access; this change doesn't affect that.
---
 modules/libpref/init/all.js     | 10 +++++++++-
 widget/windows/nsFilePicker.cpp | 28 +++++++++++++++++++++-------
 2 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 08817b45f9..d4b983639b 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -3635,6 +3635,14 @@ pref("ui.osk.require_win10", false);
 // or appearing when it is not expected.
 pref("ui.osk.debug.keyboardDisplayReason", "");
 
+// Whether to follow `.lnk` (etc.) shortcuts in the Windows file-open dialog.
+//
+// Valid values:
+//  * 0: never
+//  * 1: always
+//  * 2: auto
+pref("widget.windows.follow_shortcuts_on_file_open", 2);
+
 # XP_WIN
 #endif
 
@@ -3989,9 +3997,9 @@ pref("autocomplete.ungrab_during_mode_switch", true);
 // toggling to use the XUL filepicker
 pref("ui.allow_platform_file_picker", true);
 
+#ifdef MOZ_WIDGET_GTK
 // Allow for using the native GTK file picker. If the application is not run
 // with GTK_USE_PORTAL=1 this pref has no effect.
-#ifdef MOZ_WIDGET_GTK
 pref("widget.allow-gtk-native-file-chooser", false);
 #endif
 
diff --git a/widget/windows/nsFilePicker.cpp b/widget/windows/nsFilePicker.cpp
index e2e0ab01f7..006a0ae8ee 100644
--- a/widget/windows/nsFilePicker.cpp
+++ b/widget/windows/nsFilePicker.cpp
@@ -11,6 +11,7 @@
 #include <cderr.h>
 
 #include "mozilla/mscom/EnsureMTA.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/UniquePtr.h"
 #include "mozilla/WindowsVersion.h"
 #include "nsReadableUtils.h"
@@ -33,6 +34,7 @@ using mozilla::IsWin8OrLater;
 using mozilla::IsWin10OrLater;
 using mozilla::MakeUnique;
 using mozilla::mscom::EnsureMTA;
+using mozilla::Preferences;
 using mozilla::UniquePtr;
 using namespace mozilla::widget;
 
@@ -950,20 +952,32 @@ nsFilePicker::ShowFilePicker(const nsString& aInitialDir, bool &aWasInitError)
   // just in case.
   AutoRestoreWorkingPath arw;
 
-  // mode specific
+  // mode specification
   switch(mMode) {
-    case modeOpen:
-      fos |= FOS_FILEMUSTEXIST;
-      break;
-
     case modeOpenMultiple:
-      fos |= FOS_FILEMUSTEXIST | FOS_ALLOWMULTISELECT;
+      fos |= FOS_ALLOWMULTISELECT;
+      MOZ_FALLTHROUGH;
+
+    case modeOpen: {
+      fos |= FOS_FILEMUSTEXIST;
+      int32_t followLinks = Preferences::GetInt("widget.windows.follow_shortcuts_on_file_open", 2);
+      switch (followLinks) {
+        case 1:
+          break;
+        case 2:
+          // No special handling at the moment for `auto`. Fallthrough to `never`:
+          MOZ_FALLTHROUGH;
+        default:
+          fos |= FOS_NODEREFERENCELINKS;
+      }
       break;
+    }
 
     case modeSave:
       fos |= FOS_NOREADONLYRETURN;
       // Don't follow shortcuts when saving a shortcut, this can be used
-      // to trick users (bug 271732)
+      // to trick users (BZ bug 271732). _Do_ follow shortcuts when not saving a
+      // shortcut (BZ bug 283730).
       if (IsDefaultPathLink())
         fos |= FOS_NODEREFERENCELINKS;
       break;