Web Inspector: [Mac] Saving webarchives via Web Inspector in Safari creates files that are not double clickable

• Component: Web Inspector
• Status: RESOLVED WONTFIX

[Joseph Pecoraro]

* SUMMARY
Saving webarchives with Web Inspector in Safari creates file that gets stopped by Gatekeeper when double clicked. This doesn't happen when saving a web archive from Safari itself, so this is unexpected.

[Joseph Pecoraro]

<rdar://problem/18323498>

[Joseph Pecoraro]

Created attachment 242576 [details]
[PATCH] Proposed Fix

[Alexey Proskuryakov]

Comment on attachment 242576 [details]
[PATCH] Proposed Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=242576&action=review

> Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm:63
> +static void removeQuarantinePropertiesFromFile(NSURL *path)

It seems unfortunate to have multiple copies of this non-trivial function.

> Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm:383
> +        removeQuarantinePropertiesFromFile(actualURL);

This looks strange to me. If an application gets its files automatically quarantined, then can it actually remove the quarantine?

[Joseph Pecoraro]

(In reply to comment #3)
> Comment on attachment 242576 [details]
> [PATCH] Proposed Fix
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=242576&action=review
> 
> > Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm:63
> > +static void removeQuarantinePropertiesFromFile(NSURL *path)
> 
> It seems unfortunate to have multiple copies of this non-trivial function.

Yep. I considered putting this in WebCore/platform/FileSystemMac.mm. Would you prefer that?


> > Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm:383
> > +        removeQuarantinePropertiesFromFile(actualURL);
> 
> This looks strange to me. If an application gets its files automatically
> quarantined, then can it actually remove the quarantine?

I had only tested with Safari, and that was the case.

It seems anyone can remove the xattr from a file. For example:

    shell> xattr -d com.apple.quarantine /path/to/file

[Alexey Proskuryakov]

> Yep. I considered putting this in WebCore/platform/FileSystemMac.mm. Would
> you prefer that?

Yes.

> It seems anyone can remove the xattr from a file.

It's not anyone, this depends on their sandbox. A correct sandbox would normally disallow that, and I thought that AppSandbox did.

[Joseph Pecoraro]

Created attachment 242582 [details]
[PATCH] Proposed Fix

Shared the code in FileSystemMac. If there is an error removing the quarantine property it is fine to ignore it.

[Alexey Proskuryakov]

Comment on attachment 242582 [details]
[PATCH] Proposed Fix

We decided that we don't need this.