Given the short timeframe we have towards Fennec 68.10 I want to suggest three options: - We remove support for `content://`. Not just from the manifest and through the `VIEW` intent, but also from the code introduced by 1406903 and 1499618 - We remove just the code introduced by bug 1499618 since that is probably the culprit here, trying to be smart about content urls, and doing the actual file copy to a temporary file which is then served. - We fix this properly. Keeping the existing functionality but putting proper URL santization and whatever else needed on the handling of content:// URIs Considering the future of Fennec, my personal preference would be the first option. But it may also be the most risky one since it may touch a lot of code. Although mostly removal probably.
Bug 1647078 Comment 18 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Given the short timeframe we have towards Fennec 68.11 I want to suggest three options: - We remove support for `content://`. Not just from the manifest and through the `VIEW` intent, but also from the code introduced by 1406903 and 1499618 - We remove just the code introduced by bug 1499618 since that is probably the culprit here, trying to be smart about content urls, and doing the actual file copy to a temporary file which is then served. - We fix this properly. Keeping the existing functionality but putting proper URL santization and whatever else needed on the handling of content:// URIs Considering the future of Fennec, my personal preference would be the first option. But it may also be the most risky one since it may touch a lot of code. Although mostly removal probably.
Given the short timeframe we have towards Fennec 68.11 I want to suggest three options: - We remove support for `content://`. Not just from the manifest and through the `VIEW` intent, but also from the code introduced by 1406903 and 1499618 - We remove just the code introduced by bug 1499618 since that is probably the culprit here, trying to be smart about content urls, and doing the actual file copy to a temporary file which is then served. - We fix this properly. Keeping the existing functionality but putting proper URL santization and whatever else needed on the handling of content:// URIs Considering the future of Fennec, my personal preference would be the first option. But it may also be the most risky one since it may touch a lot of code. Although mostly removal probably. Let's try to make a decision soon. It is not entirely clear what path to take.