HiddenBrowser saves files to disk when response has Content-Disposition: attachment

[AbeJellinek]

#!/usr/bin/env python3

from http.server import HTTPServer, BaseHTTPRequestHandler

class Handler(BaseHTTPRequestHandler):
	def do_GET(self):
		self.send_response(200)
		self.send_header('Content-Type', 'text/html')
		if self.path == '/' or self.path == '/index.html':
			self.end_headers()
			self.wfile.write(b'<iframe src="iframe.html">')
		elif self.path == '/iframe.html':
			self.send_header('Content-Disposition', 'attachment')
			self.end_headers()
			self.wfile.write(b'iframe content')

httpd = HTTPServer(('', 8000), Handler)
httpd.serve_forever()

In Zotero:

var { HiddenBrowser } = ChromeUtils.import("chrome://zotero/content/HiddenBrowser.jsm");
var browser = new HiddenBrowser({ docShell: { allowMetaRedirects: true } });
await browser.load('http://localhost:8000/', { requireSuccessfulStatus: true });

browser = new HiddenBrowser({ docShell: { allowMetaRedirects: true } });
await browser.load('http://localhost:8000/iframe.html', { requireSuccessfulStatus: true });

iframe.html is saved to ~/Downloads in both cases. I would think that passing docShell: { allowContentRetargeting: false } would prevent this, but it doesn't.

[AbeJellinek]

This is a difficult one! Best lead I have so far is BackgroundThumbnailsChild, which does things very differently from HeadlessShell: https://searchfox.org/mozilla-central/rev/f9157a03835653cd3ece8d2dc713a782b7e4374e/toolkit/actors/BackgroundThumbnailsChild.sys.mjs#44-85

For one, it creates a top-level browser pointing to a chrome document and then sets a bunch of flags and loads content pages from the actor child.

[AbeJellinek]

May be related: https://forums.zotero.org/discussion/comment/462257/#Comment_462257