documentation_complete: true

title: 'Enable Downloading and Opening File Confirmation'

description: |-
    To have an action dialog box appear promping users what action to take when
    certain types of files are downloaded or opened, set
    <tt>plugin.disable_full_page_plugin_for_types</tt> to
    <tt><sub idref="var_required_file_types" /></tt>.

rationale: |-
    When the user receives a dialog box asking if they want to save the file
    or open it with a specified application, this indicates that a plugin does
    not exist. Also, the user has not previously selected a download action or helper
    application to automatically use for that type of file. When prompted, if the user
    checks the option to 'Do this automatically for files like this from now on', then
    an entry will appear for that type of file in the plugins listing, and this file
    type is automatically opened in the future. This can be a security issue. New file
    types cannot be added directly to the Application plugin listing.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF110

ocil_clause: 'it is not set or application listing is incorrect'

ocil: |-
    To verify that downloading and opening file confirmation is enabled,
    run the following command:
    <pre>$ grep 'plugin.disable_full_page_plugin_for_types' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("plugin.disable_full_page_plugin_for_types", "<sub idref="var_required_file_types" />");</pre>
