Recently I've noticed when drag/drop a URL from FireFox Browser, an additional file is displaying
"Zone.Identifier"
What settings allow this file to be visible?
never knew about this additional file type until DO13,24.
Is this now un-hidden file actually necessary to make the URL shortcut work when double clicked?
also I just accidentally learned about the options select a file name and press [CTRL] so cool.
I don't think that's a change on our side of things.
What happens when you drag the same thing from Firefox to File Explorer?
No Zone.Identifier file is created.
Directory Opus 13.24.5 (Beta) Build 9510 x64
OS 10.0 (B:26200 P:2 T:1) SP 0.0
I've noticed this behavior also, it seems to have manifested since updating from Firefox 152.x to Firefox 153.x.
I installed a FF 152.0.6 portable version to test, and it doesn't create a zone.identifier file.
I just did a test and it also doesn't actually download the file when dropping on File Explorer; it just creates a shortcut URL.
Debugging what happens when Firefox drops the file on Opus, it's saying there are two files being dropped, one named like Downloaded File.exe and the other Downloaded File.exe:Zone Identifier.
We can probably detect that and deal with it, but it's an odd change for Firefox to make, and not something any other browser I've tested is doing.
(Not a change in Opus, either. The same thing happens with old versions of Opus.)
Typically this is just data that's written to the ADS right? I've never seen this happen before in older versions of FF. If it's being handled in Explorer.exe, then it's being written transparently to the ADS.
Yes, although no other browser I know of adds it (at least in that way) for drag & drops and Firefox didn't until a recent update.
I think our code is sanitising the filename (since including ADS like that in drag & drop data, as a separate file, is definitely not normal), which is why it's being written to a separate file instead of an ADS stream.
I'm not sure it is really, since Explorer.exe reacts to the drop by creating a .URL shortcut to the download, rather than downloading the actual file. (Which is odd, since the file data is there in the drag & drop object and Firefox went to the trouble of downloading it, only for the most common file manager to throw the data away and make a shortcut... Firefox is doing something strange here, or at least, I don't understand what they are trying to do vs what happens in any program I've tested with. They're doing something that makes sense in theory, but doesn't seem to produce useful results in anything.)
I also wonder what Firefox expects to happen if the file is dragged to a drive that doesn't support ADS.
Very odd that Firefox is adding it even for shortcuts to pages, not just downloads.
That makes me wonder if this is just a bug in Firefox. No other browser does that and it doesn't really make sense for a zone identifier to be added to a .URL shortcut (the URL it points to tells you the zone).
so this is happening to other people and not a PC virus?
We’ll have a workaround for this in the next update.
Looks like Firefox fixed the issue in today's 153.0.3 update.
Per the release notes;
"Fixed Internet shortcuts dragged from Firefox to the desktop being marked as untrusted on Windows, which caused a security warning every time they were opened. (Bug 2056865)"
