Access Restrictions Whitelist ignored in Firefox 106.0.1

[rugabunda]

Describe what you noticed and did

1. run firefox
2. install videodownloadhelper addon, and companion co-app
3. whitelist net.downloadhelper.coapp-win-64.exe in start restrictions (C:\Program Files\net.downloadhelper.coapp\bin\net.downloadhelper.coapp-win-64.exe)

4. load firefox
5. note:

How often did you encounter it so far?

After Firefox 106.0

Affected program

videodownloadhelper co-app

Download link

Addon: https://addons.mozilla.org/en-CA/firefox/addon/video-downloadhelper/
Co-app: https://www.downloadhelper.net/install-coapp

Where is the program located?

The program is installed both inside and outside the sandbox.

Expected behavior

Whitelist should not be bypassed

What is your Windows edition and version?

Win 11 21H2

In which Windows account you have this problem?

I use the built-in Administrator with Admin Approval Mode turned on.

Please mention any installed security software

ESET

What version of Sandboxie are you running?

1.5.0 / 1.5.1 #2391 (comment)

Is it a new installation of Sandboxie?

I just updated Sandboxie from a previous version (to be specified).

Is it a regression?

No response

In which sandbox type you have this problem?

In a standard isolation sandbox (yellow sandbox icon).

Can you reproduce this problem on an empty sandbox?

I can confirm it also on an empty sandbox.

Did you previously enable some security policy settings outside Sandboxie?

No response

Crash dump

No response

Trace log

No response

Sandboxie.ini configuration

No response

[rugabunda]

Problem appeared to begin after updating to firefox 1.0.6.0; I believe this was before the sbie release fixing video problems in firefox.

[bastik-1001]

I see this as well, with Sandboxie 1.5.0 and 1.5.1.

[isaak654]

Isn't it the same of #724 (comment) ?

[rugabunda]

Isn't it the same of #724 (comment) ?

Perhaps, but it just started for me in recent releases, never had a problem until the last week or so

[bastik-1001]

Sandboxie creates a copy of "C:\Program Files\net.downloadhelper.coapp\bin\net.downloadhelper.coapp-win-64.exe", which it seemingly didn't do before. That assumption is based on the fact that the message came up with Sandboxie 1.5.0.

Adding DontCopy=C:\Program Files\net.downloadhelper.coapp\bin\net.downloadhelper.coapp-win-64.exe to the .ini section for the box with the start restriction, where this process is whitelisted, does indeed not copy the file and therefore does not show the error. Thank you isaak for pointing to the other issue, which made me check if the reason was that the application was being copied.

[rugabunda]

Thank you @bastik-1001 , problem solved. How would this be dealt with in the official version? A dedicated compatibility template? Is the copying a bug?

[DavidXanatos]

I have investigated this issue and firefox's xul.dll is requesting GENERIC_WRITE on net.downloadhelper.coapp-win-64.exe and sandboxie as it should then migrates the file into the sandbox, so apparently this issue must be caused by a recent change in forefox and not in sandboxie.

the DontCopy approach is the right fix for this problem, it should be put into a compatibility template.

[isaak654]

Well, there is already a template which seems fit for purpose:

Sandboxie/Sandboxie/install/Templates.ini

Lines 3364 to 3372 in 6177d84

	[Template_FileCopy]
	Tmpl.Title=#4295
	Tmpl.Class=Misc
	DontCopy=*.url
	CopyEmpty=*\microsoft\windows\explorer\thumbcache_*
	CopyEmpty=*\microsoft\windows\explorer\iconcache_*
	# firefox
	CopyAlways=*\places.sqlite
	CopyAlways=*\xul.mfl

[DavidXanatos]

This seam to be a generic firefox issue, it tryes to open any plugin for writing looks like a ff bug to me, same issue with roboform.
So I'm looking towards a generic fix for booth as well as other unknown plugins...

[rugabunda]

This seam to be a generic firefox issue, it tryes to open any plugin for writing looks like a ff bug to me, same issue with roboform. So I'm looking towards a generic fix for booth as well as other unknown plugins...

Thank you David

[bastik-1001]

Can anyone see a reason why Firefox changed its behavior? Thank you for working around that issue.