127427 - Remote HTML-file does not accept local saved CSS-file

Status: VERIFIED INVALID

(Core :: Security, defect)

Description

[christian.haake]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:0.9.8) Gecko/20020204
BuildID:    2002020406

If you have a html-file in the web, which refers to a css file on your system like
<link rel="stylesheet" type="text/css" href="file:///local-path/local-css-file.css">
Mozillla does not use this css-file, but it uses a local saved image file (img
src="file:///local-path/local-image.gif). Why does Mozilla not use this css-file?

Reproducible: Always
Steps to Reproduce:
1.Write a HTML-file which refers to a CSS-file on your system with a total path
(file:///path/file.css)
2.Copy this HTML-file into the web on a remote system
3.Load this webpage with Mozilla

Actual Results:  Mozilla does not use the CSS-file

Expected Results:  Mozilla should use the information in the CSS-file

Comment 1

[christian.haake]

I do have an example on the web (the original uri I used), useful for Windows-users:
save following two files in the local folder c:\test
http://www-stud.uni-essen.de/~sp8003/localcss/local-css-file.css
http://www-stud.uni-essen.de/~sp8003/localcss/localpicture.gif
Then load the html-file:
http://www-stud.uni-essen.de/~sp8003/localcss/local_saved_css-file.html

Comment 2

[Christopher Hoess (gone)]

->Security (probably has to do with our policies on file://)

Comment 3

[Boris Zbarsky [:bzbarsky]]

This is not a bug but rather a basic security precaution -- remote should not be
able to access local content.  The fact that it can for images is a bug and a
major security problem which is being worked on.

You can turn off this security check by putting:

user_pref("security.checkloaduri", false);

in your prefs.js or user.js

Comment 4

[Alexey Chernyak]

vrfy

Comment 5

[christian.haake]

But does Mozilla sends a message to the webserver, if the image or css-file is
found or not found? Otherwise it is in my opinion no security problem, because
the server will not be informed of the local content you have. And this local
content can do no harm to you, if the accessable content is not harmful, and
images and css definitions are not harmful. So where is the problem then?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Of course the server gets a message.  There is an onload event that is fired
when the load is complete.  :)

See Bug 84128, comment 20 as well as bug 101207, comment 4 (trivial remote crash
exploit through accessing local files described there).