Open dialog displays "from: blob:"

NEW
Unassigned

Status

()

Toolkit
Downloads API
--
minor
4 years ago
5 months ago

People

(Reporter: Gijs, Unassigned)

Tracking

30 Branch
Points:
---
Bug Flags:
firefox-backlog +

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

4 years ago
NB: cloning from bug 1046240 because that's been repurposed to create an API so we can actually show the origin in the relevant dialog. Now we need to use that API and fix the dialog...

+++ This bug was initially created as a clone of Bug #1046240 +++

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

Trigger a file open dialog on a link where the href attribute points to a blob.

For example:
1) Open index.html in the demo of FileSaver.js (https://github.com/eligrey/FileSaver.js)
2) Click on any of the buttons labeled save
3) A dialog box titled Opening <filename> will display


Actual results:

The open dialog box will show "from: blob:"


Expected results:

The open dialog should show "from: <domain>"

E.g. if I generated a blob from data on www.mozilla.org the dialog should show:
"from: www.mozilla.org"

Ideally it would be good to be able to set the from: field in javascript independently from the href attribute. This would allow for setting a more meaningful/user-friendly string such as "from: Company Name". I understand this could present security concerns but "from: blob:" is less secure. At least the dialog should say "from: <site>" where <site> is the site hosting the code which generated the blob/link when the file is a blob.
Flags: firefox-backlog+
(In reply to :Gijs Kruitbosch (intermittently here 14-15 August; then away until 19th) from comment #0)
> NB: cloning from bug 1046240 because that's been repurposed to create an API
> so we can actually show the origin in the relevant dialog. Now we need to
> use that API and fix the dialog...

The new API extends the URL object and it's available for chome only. This allows to do:

  var principal = URL.getPrincipalFromURL('blob:something');

principal will a nsIPrincipal or null in case the blob URI is unknown.
This API is not available in workers.

Comment 2

5 months ago
This bug affects data URI links in the same way.

For example, if one tries to download from:
href="data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20xmlns%3Axlink%3D%22http%3A%2F%2Fwww.w3.org%2F1999%2Fxlink%22%20version%3D%221.1%22%3E%3C%2Fsvg%3E"

The open dialog box shows "from: data:"

Expected result, in this case, is to show "from: <domain>" as proposed by :Gijs.
You need to log in before you can comment on or make changes to this bug.