Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionAfter selecting a malicious Windows <code>.url</code> shortcut from the local filesystem, an unexpected file could be uploaded. <br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*
ComponentWidget
Bug ClassLogic Error
Tracker1950056
Fix commit0bdb9dd88c50 (firefox) +25/-6
CISA KEVNot listed
CreditedAmeen Basha M K
Disclosed2025-04-01

Changed Functions

FunctionChangeNotes
switch
widget/windows/nsFilePicker.cpp
modified

Files Changed

  • modules/libpref/init/StaticPrefList.yaml
  • widget/windows/nsFilePicker.cpp
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index f53097af43d..61e90f1fb7d 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -18407,6 +18407,17 @@
   value: 0
   mirror: always
 
+# Whether to follow `.lnk` (etc.) shortcuts in the Windows file-open dialog.
+#
+# Valid values:
+#  * 0: never
+#  * 1: always
+#  * 2: auto
+- name: widget.windows.follow_shortcuts_on_file_open
+  type: RelaxedAtomicInt32
+  value: 2
+  mirror: always
+
 # The number of messages of each type to keep for display in
 # about:windows-messages
 - name: widget.windows.messages_to_log
diff --git a/widget/windows/nsFilePicker.cpp b/widget/windows/nsFilePicker.cpp
index 08d86081c76..a21f914eba6 100644
--- a/widget/windows/nsFilePicker.cpp
+++ b/widget/windows/nsFilePicker.cpp
@@ -552,18 +552,26 @@ nsFilePicker::ShowFilePicker(const nsString& aInitialDir) {
 
     // mode specification
     switch (mMode) {
+      case modeOpenMultiple:
+        fos |= FOS_ALLOWMULTISELECT;
+        [[fallthrough]];
+
       case modeOpen:
         fos |= FOS_FILEMUSTEXIST;
-        break;
-
-      case modeOpenMultiple:
-        fos |= FOS_FILEMUSTEXIST | FOS_ALLOWMULTISELECT;
+        switch (mozilla::StaticPrefs::
+                    widget_windows_follow_shortcuts_on_file_open()) {
+          case 1:
+            break;
+          default:
+            fos |= FOS_NODEREFERENCELINKS;
+        }
         break;
 
       case modeSave:
         fos |= FOS_NOREADONLYRETURN;
-        // Don't follow shortcuts when saving a shortcut, this can be used
-        // to trick users (bug 271732)
+        // Don't follow shortcuts when saving a shortcut; this can be used to
+        // trick users (bug 271732). _Do_ follow shortcuts when not saving a
+        // shortcut (bug 283730).
         if (IsDefaultPathLink()) {
           fos |= FOS_NODEREFERENCELINKS;
         }
Loading diff…