Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add source information to downloads #20790

Open
tewe opened this issue Jan 30, 2022 · 1 comment
Open

Add source information to downloads #20790

tewe opened this issue Jan 30, 2022 · 1 comment

Comments

@tewe
Copy link

tewe commented Jan 30, 2022

Description

On macOS, Safari sets an extended file system attribute called kMDItemWhereFroms on every download, to preserve the source. This is useful for files with generic names, especially when using automation like Hazel.

Please consider copying this feature.

Steps to Reproduce

  1. Download a file
  2. xattr -l

Actual result:

Just com.apple.quarantine

Expected result:

Also com.apple.metadata:kMDItemWhereFroms

Reproduces how often:

Always

Brave version (brave://version info)

Brave 1.34.81 Chromium: 97.0.4692.99 (Official Build) (x86_64)
Revision d740da257583289dbebd2eb37e8668928fac5ead-refs/branch-heads/4692@{#1461}
OS macOS Version 10.14.6 (Build 18G9323)
@rebron rebron added the Chromium/waiting upstream Issue is in Chromium; we'll likely wait for the fix label Feb 8, 2022
@Oneiroi
Copy link

Oneiroi commented Oct 15, 2024

Firstly apologies for necro'ing this issue;

however in Chrome version 1129.0.6668.101 the file xattr com.apple.metadata:kMDItemWhereFroms is being set, whilst in Brave version [Version 1.70.126 Chromium: 129.0.6668.100](https://brave.com/latest/) does not; looking at the Chromium source code, I see these code comments discussing how to best set this information on the downloaded files , the lack of metadata on the file also ensures DFIR implications, as it's not readily possible to know where the file was downloaded from without more invasive means of pulling browser history.

Additionally osquery is another example where this file metadata is being inspected and used in the extended_attributes virtual table

Please consider addressing this issue in the near future, thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Needs Info
Development

No branches or pull requests

3 participants