File URIs not accessible from webextension

RESOLVED DUPLICATE of bug 1266960

Status

()

Toolkit
WebExtensions: Untriaged
RESOLVED DUPLICATE of bug 1266960
2 years ago
2 years ago

People

(Reporter: Tom Zöhner, Unassigned)

Tracking

49 Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

2 years ago
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce:

I'm working on porting an existing chrome extension (https://github.com/zoehneto/chrome-rtf-viewer) to firefox using the webextension api. One feature of the extension is to view RTF files on the local file system (similar to a desktop word processor). To achieve this I add "file:/*" to "web_accessible_resources" in the manifest.json file and then load it using a standard XMLHttpRequest on a page of the extension (not the background script).


Actual results:

Firefox shows the error "NS_ERROR_DOM_BAD_URI: Access to restricted URI denied" in the console.


Expected results:

The local file should be loaded. This works in chrome.

Updated

2 years ago
Component: Untriaged → WebExtensions: Untriaged
Product: Firefox → Toolkit
> To achieve this I add "file:/*" to "web_accessible_resources" 

This is a _vary_ bad idea. and I doubt that's how it works in Chrome. If Firefox let you do this, it would make all of user's filesystem accessible to _public web sites_, not just your extension.

To let the users open a local file in your extension, you can use a <input type=file> or even drag and drop APIs.

https://www.html5rocks.com/en/tutorials/file/dndfiles/
(Reporter)

Comment 2

2 years ago
This works in Chrome right now and has for quite a while. Also it doesn't make files accessible to any website, since only extension with web_accessible_resources set can access the local file system. A standard file upload wouldn't work here since I want to load the file automatically when a user opens a relevant url (for example when a user opens a file using Firefox from the file manager).
I don't know why `web_accessible_resources` would have anything to do with this.

We're considering adding support for file: scheme and general filesystem access, but not in a way that will let you access the contents of arbitrary files anywhere in the local filesystem.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1266960
(Reporter)

Comment 4

2 years ago
Thanks for pointing me in the right direction, it is the "Allow access to file URLs" checkbox in chrome which allows accessing arbitrary files on the file system and is right now missing in firefox (it's probably better for security but problematic for chrome extensions depending on it).
You need to log in before you can comment on or make changes to this bug.