18

I've found out that if you download a file with Firefox, a similar window as this one pops up (in dutch in my case):

enter image description here

("Bestand opslaan" = "Save file")

However, the file is already being downloaded before I press the Ok button (i.e. I waited 1 minute before clicking on the Ok button and already 50Mb of 191Mb was downloaded).

Does this feature come with any security risks (a malicious file could be downloaded before I even had the chance to click Cancel) and should I find a way to disable it or is this perfectly safe?

Improve this question
6
  • Could someone link to any official documentation on this feature? It'd be very useful to see how / why this is done.
    – Polynomial
    Feb 5, 2013 at 16:19
  • @Polynomial Based on the answers, I found this FAQ on the Mozilla website about this feature: developer.mozilla.org/en-US/docs/Link_prefetching_FAQ
    – Aerus
    Feb 5, 2013 at 17:05
  • 3
    @Aerus: that is a different kind of link prefetching.
    – Lie Ryan
    Feb 5, 2013 at 18:53
  • 1
    Whats the problem. Your security software would begin to scan this file. I have many files blocked in Chrome because of prefetching.
    – Ramhound
    Feb 6, 2013 at 12:29
  • 2
    @Ramhound problems are (1) resource wasting (the download completely to a temp file, while the user may yet gain info about the file and decide to abort and discard the download; (2) that the temporary file is like the Browsercache content potentially accessible to processes that can be triggered to fail upon that data, something that would not happen if this downloading would simply not be done by firefox before the user confirms it with the dialog. The cancel of the dialog is a fake, the download already took place long before.
    – humanityANDpeace
    Jan 24, 2016 at 12:01

4 Answers 4

Reset to default
23

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded.

Potentially hostile files can be a security issue. Filesystems normally store files as bunch of bytes and are thus nominally immune to the file contents; but modern operating systems are not content with handling files as files. For instance, if you open a file explorer to see the directory in which downloaded files are stored, and the file has a name which ends in '.jpg' or '.png', then the file explorer will try to interpret the file contents automatically, as a picture, so as to compute and display a miniature view of the said picture. Any security hole in the JPEG or PNG support library could then be exploited by a malicious file, and it does not require any "opening click" on the file, just opening the directory.

The Web is a harsh place.

Improve this answer
4
  • 1
    this is not a problem with the web it's a problem with C for not being memory-safe
    – Longpoke
    Feb 7, 2013 at 21:20
  • 2
    @Longpoke And with dumb programmers who use C for tasks that it's not suitable for.
    – Display Name
    Feb 7, 2014 at 0:06
  • @SargeBorsch Actually C is suitable for every task you can do in any other turing complete programming language. The thing with C is that relies on the programmer to manage resources properly (Including memory)
    – Mr. E
    Dec 15, 2016 at 18:01
  • @Mr.E by suitable I mean being reasonable trade-off between probability of having disastrous security holes, potential for hardcore optimization for speed and/or size, speed of development, difficulty of maintenance, etc. Of course, in theory anything can be done in any Turing complete language, but in practice it is not always good idea (except as an exercise)
    – Display Name
    Dec 15, 2016 at 18:42
6

To disable it just write about:config in the address bar and search for network.prefetch-next.

Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be disabled.

Supposing that the file contains malware, when the pre-downloading is finished, you may receive an alert from your antivirus.

As long as you do not open the file, you should be safe. If you clicked cancel, Firefox would just delete the file.

Of course, there is always a chance that coupled with a certain vulnerability (in the browser, in the indexing software, etc) an exploit could be built, but I think this is unlikely.

Improve this answer
2
  • Thank you, changing the setting in about:config worked !
    – Aerus
    Feb 5, 2013 at 17:07
  • 3
    @Aerus That setting affects something completely different (prefetch hints, which have nothing to do with downloads). I'm surprised that it would make a difference, and I tested with Firefox 17 on Linux and indeed it doesn't. Are you sure you tested the right thing?
    – Gilles 'SO- stop being evil'
    Feb 5, 2013 at 23:43
5

I can imagine certain conditions for this to become a security issue:

  • The browser downloads the file that triggers a vulnerability in the file browser like the WMF vulnerability
  • A virus scanner might start scanning the partially downloaded file and it could trigger a vulnerability in the scanner. Sophos had some bad press recently.
  • A huge file that is highly compressible would download very quickly and could use up all drive space.
Improve this answer
2
  • The "huge files will take up all your hdd space" isn't really a security issue.
    – Ramhound
    Feb 6, 2013 at 12:31
  • 2
    Resource exhaustion is a software weakness that can be considered a security issue if it bypasses a protection mechanisms. cwe.mitre.org/data/definitions/400.html: In some cases it may be possible to force the software to "fail open" in the event of resource exhaustion. The state of the software -- and possibly the security functionality - may then be compromised.
    – Cristian Dobre
    Feb 6, 2013 at 12:55
5

Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory (platform-dependent), either with the server-supplied default file name plus a .part suffix or with a randomly-generated file name (I think that depends on the version, perhaps on the platform as well).

Firefox needs to start downloading before prompting you for a file name, because the default file name can be supplied by the server: the original link could be a redirection (so Firefox needs to initiate the connection and read the response code, and there could be a file name in a Content-Dispotition header (so with a 200 response, Firefox needs to read the headers).

There is no security risk here. When you click on something in a browser, it is expected that the browser will establish a connection and download the content at that link. Sure, there could be security issues (e.g. the content may trigger an exploitable browser bug), but that is a risk that you take by using a browser in the first place. To have every click in a browser pop up an “are you sure?” dialog box would be a usability nightmare, with no security benefit since you'd be clicking “yes” all the time anyway.

Ok, Firefox could pause the download after the headers. But that wouldn't serve any useful purpose (in addition to being bad for performance and usability). The exploit could be in the headers, after all.

Improve this answer
4
  • 1
    As you point out the security risk remains the same no matter if Firefox is set to prefetch the file or wait until you tell it has a final desination for the file before it begins to download the file. if the content is malicious its dangerous no matter what.
    – Ramhound
    Feb 6, 2013 at 12:40
  • Via this pre-downloading the data is put into the filesystem without need, and that adds to the risk (other processes might read the tempfile). Firefox could avoid this by downloading the necessary initial data and store it in memory. Only upon user interaction should any content be placed in the filesystem. Yet one might of course argue that the Browsercache also puts stuff into the filesystem.
    – humanityANDpeace
    Jan 24, 2016 at 11:49
  • @humanityANDpeace Clicking “Save link as” is a user interaction, and that's what it takes to download something outside the browser cache.
    – Gilles 'SO- stop being evil'
    Jan 24, 2016 at 12:22
  • True and to the same extend simply adding the URL of the download item (e.g. a .gz file) is also a user interaction and also triggers the creation of the file in the filesystem. The misleading thing is the offered "cancel". It is rather a "discard what has already been created as temp file". A security related issue anyway arises only in connection with further troubles (i.e. a data file put into the os' filesystem is provoking a further threat/exploit). If on the other hand firefox would only load the header to memory and pause download, the file wouldn't even exist as risky in the fs.
    – humanityANDpeace
    Jan 24, 2016 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .