wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 15:28:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

[widget] Extend the use of FOS_NODEREFERENCELINKS on Windows.

Browse source 
In the modern era of user-customizable Quick Access sidebars on every file
dialog, navigating via `.lnk` files is considerably less useful than it
was twenty years ago.

Disable link-following in file-open dialogs by default, to prevent any of
the usual security issues involving symlink smuggling.

Allow overriding this behavior via a pref, for users who want to trade off
this security issue for convenience of being able to follow links inside
file dialogs (older OSes and established user workflows).
Note: File Save dialogs have a set of more nuanced guards against link
smuggling and protected file access; this change doesn't affect that.
This commit is contained in:
Moonchild 2025-04-02 14:31:19 +02:00 • committed by roytam1
commit 1283a5f874
2 changed files with 30 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

28
widget/windows/nsFilePicker.cpp
View file

@ -11,6 +11,7 @@
#include <cderr.h>
#include "mozilla/mscom/EnsureMTA.h"
#include "mozilla/Preferences.h"
#include "mozilla/UniquePtr.h"
#include "mozilla/WindowsVersion.h"
#include "nsReadableUtils.h"
@ -33,6 +34,7 @@ using mozilla::IsWin8OrLater;
using mozilla::IsWin10OrLater;
using mozilla::MakeUnique;
using mozilla::mscom::EnsureMTA;
using mozilla::Preferences;
using mozilla::UniquePtr;
using namespace mozilla::widget;
@ -950,20 +952,32 @@ nsFilePicker::ShowFilePicker(const nsString& aInitialDir, bool &aWasInitError)
// just in case.
AutoRestoreWorkingPath arw;
// mode specific
// mode specification
switch(mMode) {
case modeOpen:
fos |= FOS_FILEMUSTEXIST;
break;
case modeOpenMultiple:
fos |= FOS_FILEMUSTEXIST | FOS_ALLOWMULTISELECT;
fos |= FOS_ALLOWMULTISELECT;
MOZ_FALLTHROUGH;
case modeOpen: {
fos |= FOS_FILEMUSTEXIST;
int32_t followLinks = Preferences::GetInt("widget.windows.follow_shortcuts_on_file_open", 2);
switch (followLinks) {
case 1:
break;
case 2:
// No special handling at the moment for `auto`. Fallthrough to `never`:
MOZ_FALLTHROUGH;
default:
fos |= FOS_NODEREFERENCELINKS;
}
break;
}
case modeSave:
fos |= FOS_NOREADONLYRETURN;
// Don't follow shortcuts when saving a shortcut, this can be used
// to trick users (bug 271732)
// to trick users (BZ bug 271732). _Do_ follow shortcuts when not saving a
// shortcut (BZ bug 283730).
if (IsDefaultPathLink())
fos |= FOS_NODEREFERENCELINKS;
break;