Where did you install Firefox from? Help Mozilla uncover 3rd party websites that offer problematic Firefox installation by taking part in our campaign. There will be swag, and you'll be featured in our blog if you manage to report at least 10 valid reports!

Sök i support

Akta dig för supportbedrägerier: Vi kommer aldrig att be dig att ringa eller skicka ett sms till ett telefonnummer eller dela personlig information. Rapportera misstänkt aktivitet med alternativet "Rapportera missbruk".

Learn More

Firefox 127+ Downloaded Filenames Appended With Underscores In Some Circumstances

more options

Problem: When exporting or downloading content from the GUI in the digital forensics tool Velociraptor, underscores are appended to the beginning and end of filenames. File is otherwise downloaded correctly, but removal of underscores necessary if original filename is desired. One hypothesis is that perhaps for security reasons there were changes made in Firefox 127 for how character escaping is performed.

Tested Operating Systems: Ubuntu 24.04, Windows 11 22H2, Windows 11 24H2, macOS Sonoma (14.5) Affected Firefox version(s): Confirmed 127.0, 127.0.1, 127.0.2 Tested Firefox versions which do not reproduce the behavior: 126.x, 125.x > Testing Microsoft Edge, Chromium, Google Chrome on Windows, macOS, Linux: files download with correct name as expected. Testing performed with clean installations on clean VMs with no add-ons enabled.

To reproduce: Download the latest release of Velociraptor from Github (at the time of this writing, 0.72.3) for preferred platform / operating system. Run Velociraptor using the gui switch, e.g. "$sudo velociraptor-v0.72.3-windows-amd64 gui" or "$ velociraptor-v0.72.3-windows-amd64.exe gui" Navigate to Server Artifacts and click the "+" icon at the top Search for Server.Utils.CreateMSI - select and press Launch Select the newly-created flow, click "Uploaded Files" tab and click vfs_path to download the file or, click the Notebook tab and click Download JSON or Download CSV buttons to download JSON or CSV respectively, underscores are appended to beginning and end of filenames.

Problem: When exporting or downloading content from the GUI in the digital forensics tool Velociraptor, underscores are appended to the beginning and end of filenames. File is otherwise downloaded correctly, but removal of underscores necessary if original filename is desired. One hypothesis is that perhaps for security reasons there were changes made in Firefox 127 for how character escaping is performed. Tested Operating Systems: Ubuntu 24.04, Windows 11 22H2, Windows 11 24H2, macOS Sonoma (14.5) Affected Firefox version(s): Confirmed 127.0, 127.0.1, 127.0.2 Tested Firefox versions which do not reproduce the behavior: 126.x, 125.x > Testing Microsoft Edge, Chromium, Google Chrome on Windows, macOS, Linux: files download with correct name as expected. Testing performed with clean installations on clean VMs with no add-ons enabled. To reproduce: Download the latest release of Velociraptor from Github (at the time of this writing, 0.72.3) for preferred platform / operating system. Run Velociraptor using the gui switch, e.g. "$sudo velociraptor-v0.72.3-windows-amd64 gui" or "$ velociraptor-v0.72.3-windows-amd64.exe gui" Navigate to Server Artifacts and click the "+" icon at the top Search for Server.Utils.CreateMSI - select and press Launch Select the newly-created flow, click "Uploaded Files" tab and click vfs_path to download the file or, click the Notebook tab and click Download JSON or Download CSV buttons to download JSON or CSV respectively, underscores are appended to beginning and end of filenames.
Bifogade skärmdumpar

Alla svar (2)

more options

Is Firefox sanitizing the filename?

What filename does the server send if you check the HTTP response headers in the Network Monitor?

Hjälpsam?

more options

Response Headers shows:

content-disposition attachment; filename*=utf-8""; filename=""

Looking at Response Headers in a version of Firefox such as 125, in which downloads are not appended with underscores, the response headers appear to be the same. Screenshot attached of Firefox 127.0.2 Response Headers

Thank you very much for your help.

Hjälpsam?

Ställ en fråga

Du måste logga in på ditt konto för att svara på inlägg. Vänligen starta en ny fråga om du inte har ett konto ännu.