Rohit Dube wrote:
Hi, This is just a question. While using opera, I observed that as soon as it prompts you for file download, it simultaneously starts the download with same file extension in its %USERPROFILE/application data/opera/cache. Even if the user afterwards chooses cancel, this temporary file does not getdeleted.
There are plenty of vulnerabilities that require you to know the location of a file. So if you know the value of %USERPROFILE (which is available to things like JScript, isn't it?) and can convince the user to download your file, this could probably be exploitable.
I expect Opera's convinced it's not a bug because other browsers seem to do the same thing. I haven't done detailed investigation, but both IE and Mozilla FireFox seem to begin the download to a temp folder as soon as you click the link. I expect it's to make the download take less time from the user's point of view. I've noticed on several occasions that whatever progress indicator is used in the browser I'm using, it seems to start out not from the beginning, but somewhere in the middle, indicating that the browser already began downloading.
Josh Tolley