View source for Network.jar.open-unsafe-types

{{preference|pref=network.jar.open-unsafe-types}}

==Background==
Mozilla supports the <code>jar:</code> protocol, which allows the browser to directly load files inside [http://en.wikipedia.org/wiki/JAR_(file_format) JAR archives] (and other files based on [http://en.wikipedia.org/wiki/ZIP_(file_format) ZIP]). Unfortunately, this feature can open up cross-site scripting issues on otherwise secure sites, by allowing script content to be loaded inside pages with the same permissions as the page itself. Another bug related to redirects compounded the problem, allowing any site with an open redirect to be compromised the same way, even if it hosted no JAR files.

As part of the patch for this vulnerability, the <code>jar:</code> protocol was modified so that only files sent with Content-Types of <code>application/java-archive</code> or <code>application/x-jar</code> could be loaded. This preference determines whether or not to override that restriction, restoring the old behavior.

Local files are not subject to this restriction, though they are subject to standard [[Links to local pages do not work|checkloaduri restrictions]].

==Possible values and their effects==
===True===
Allow any valid file to be loaded with the <code>jar:</code> protocol, even if its Content-Type is not considered “safe.”
===False===
Restrict <code>jar:</code> to files served with the proper Content-Types.

==Recommended settings==
Changing this preference to true is not recommended unless you have absolute control over the sites the browser is able to visit. While measures were taken to prevent content loaded via <code>jar:</code> from gaining undue permissions, requiring proper Content-Types is added protection.

==First checked in==
[http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=nsJARChannel.cpp&branch=&root=/cvsroot&subdir=mozilla/modules/libjar&command=DIFF_FRAMESET&rev1=1.126&rev2=1.127 2007-11-26 by Dave Camp]

==Has an effect in==
* Mozilla Firefox (all versions since 2.0.0.10)
* SeaMonkey (all versions since 1.1.7)

==Related bugs==
* [https://bugzilla.mozilla.org/show_bug.cgi?id=369814 Bug 369814 - jar: protocol is an XSS hazard due to ignoring mime type and being considered same-origin with hosting site]

==External links==
* [http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues Web Mayhem: Firefox’s JAR: Protocol issues]
* [http://www.mozilla.org/security/announce/2007/mfsa2007-37.html MFSA 2007-37: jar: URI scheme XSS hazard]

[[Category:Preferences]]