Firefox appends underscores before and after the file name upon download

[dutty5]

Describe the bug

Firefox appends underscores before and after the file name of the downloaded file

Steps to reproduce

1. Start Firefox
2. Navigate to oCIS personal folder
3. Select any single file by clicking the checkbox and click download. Alternatively, use context menu.
4. Downloaded file will have appended underscores in the beginning and in the end of the filename, for example 'text.xlsx' wil be downloaded and saved as '_test.xlsx_'.

Expected behavior

There should be no appending underscores in the filename upon download.

Actual behavior

Firefox appends underscores before and after the file name of the downloaded file

Setup

• oCIS bare metal setup, version 5.0.5, Web version 8.0.2, on RHEL 8.10
• Freshly installed Firefox 115.12.0esr and 127.0 checked on Mac OS Sonoma 14.5 and Big Sur 11 - same behavior
• also checked freshly installed Firefox 115.12.0esr on Windows 8.1 - same behavior

Additional context

Similar looking problem mentioned here https://stackoverflow.com/questions/22477273/firefox-and-chrome-appending-underscore-before-and-after-file-name-while-interne

However oCIS has this problem only in Firefox. Safari, Chrome and Edge seem to be fine.

[update]
I checked with different file types (file extensions) and I observe this behavior with *.txt, *.xlsx, *.docx, *.tar.gz, *.drawio (underscores added both in the beginning and in the end). For *.pdf and *.mp4 only leading underscore is appended, and the file extension in the end of a filename remains (properly) unchanged. Characters in the filename seem to be not a factor.

[update2]
Looks like something changed in latest Firefox versions (probably JS engine related). I do not see this problem in Firefox 115.10.0esr.

[dutty5]

Might be related (?): https://www.tenable.com/cve/CVE-2024-5692

[AlexAndBear]

Using FF 123.0.1 (64-bit): The described error doesn't appear. After updating to 127.0.1 (64-bit) the problem does indeed exist.

[JammingBen]

Has been fixed via cs3org/reva#4748 and will be part of the upcoming ocis rolling release.