X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How to prevent firefox from resolving symlinks

Posted

Following "How to prevent version 13.0 from following symlinks"

I was developing a test framework and there was a symlink test.html inside every folder. As long as now firefox resolves symlinks, I promised to have a look at the code. (wonderful and marvelous mozilla code and docs. Thx people.)

I found in mozilla-central/netwerk/protocol/file/nsFileChannel.cpp

The following code

nsFileChannel::nsFileChannel(nsIURI *uri) {

 // If we have a link file, we should resolve its target right away.
 // This is to protect against a same origin attack where the same link file
 // can point to different resources right after the first resource is loaded.
 nsCOMPtr<nsIFile> file;
 nsCOMPtr <nsIURI> targetURI;
 nsAutoCString fileTarget;
 nsCOMPtr<nsIFile> resolvedFile;
 bool symLink;
 nsCOMPtr<nsIFileURL> fileURL = do_QueryInterface(uri);
 if (fileURL && 
     NS_SUCCEEDED(fileURL->GetFile(getter_AddRefs(file))) &&
     NS_SUCCEEDED(file->IsSymlink(&symLink)) && 
     symLink &&
     NS_SUCCEEDED(file->GetNativeTarget(fileTarget)) &&
     NS_SUCCEEDED(NS_NewNativeLocalFile(fileTarget, PR_TRUE, 
                                        getter_AddRefs(resolvedFile))) &&
     NS_SUCCEEDED(NS_NewFileURI(getter_AddRefs(targetURI), 
                  resolvedFile, nullptr))) {
   SetURI(targetURI);
   SetOriginalURI(uri);
   nsLoadFlags loadFlags = 0;
   GetLoadFlags(&loadFlags);
   SetLoadFlags(loadFlags | nsIChannel::LOAD_REPLACE);
 } else {
   SetURI(uri);
 }

}


If you force the false branch SetURI(uri) in any case, firefox stops resolving the symlinks. This is a very local solution, but as you can see in the first comment, resolving the symlink is intentional.

So the questions are:

 Is mozilla people going to provide another solution to solve security risks without breaking backward compatibility with our code?
Who do we have to post our question to?

Thanks to all for your support.

Post a Reply

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.2 r202
  • The IcedTea-Web Plugin executes Java applets.
  • This plug-in detects the presence of iTunes when opening iTunes Store URLs in a web page with Firefox.
  • DivX Web Player version 1.4.0.233
  • The Totem 3.0.1 plugin handles video and audio streams.

Application

  • User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:19.0) Gecko/20100101 Firefox/19.0

More Information

jscher2000
  • Top 10 Contributor
1181 solutions 11181 answers
Posted

Link to earlier (closed) thread for reference: https://support.mozilla.org/en-US/questions/929923

Was this helpful to you?
Reply
Posted

Question owner

I have forked mozilla-central at github.com inside my profile (https://github.com/txemagon/) and I also have cloned it with hg (inbound-src as well)

I have changed nsFileChannel.cpp to accept a preference (about:config) network.file.allowSymlinks

Whenever is set to true then firefox gives up from resolving symlinks.

But, does someone know if I can make a pull request?

Is it possible to contact the module owner to discuss this change in mozilla? Where can I find him?

I'm pretty new to contributing so a warm face to lead my first steps would be just wonderful.

Was this helpful to you?
Reply
jscher2000
  • Top 10 Contributor
1181 solutions 11181 answers
Posted

Mozilla has a variety of development mailing lists, but I don't have a sense of which one is the most appropriate; maybe the general Firefox list? Also, have you considered creating a new bug on Bugzilla?

Was this helpful to you?
Reply
Posted

Question owner

I found a bug with the same issue. Added a comment referencing a possible solution. I'll keep you informed.

Was this helpful to you?
Reply

Post a Reply

You must log in to your account to reply to posts.

Don't have an account? You can create a free account now.