1313867 - File URIs not accessible from webextension

Status: RESOLVED DUPLICATE of bug 1266960

(WebExtensions :: Untriaged, defect)

Description

[Tom Zöhner]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce:

I'm working on porting an existing chrome extension (https://github.com/zoehneto/chrome-rtf-viewer) to firefox using the webextension api. One feature of the extension is to view RTF files on the local file system (similar to a desktop word processor). To achieve this I add "file:/*" to "web_accessible_resources" in the manifest.json file and then load it using a standard XMLHttpRequest on a page of the extension (not the background script).


Actual results:

Firefox shows the error "NS_ERROR_DOM_BAD_URI: Access to restricted URI denied" in the console.


Expected results:

The local file should be loaded. This works in chrome.

Comment 1

[Tomislav Jovanovic :zombie]

> To achieve this I add "file:/*" to "web_accessible_resources" 

This is a _vary_ bad idea. and I doubt that's how it works in Chrome. If Firefox let you do this, it would make all of user's filesystem accessible to _public web sites_, not just your extension.

To let the users open a local file in your extension, you can use a <input type=file> or even drag and drop APIs.

https://www.html5rocks.com/en/tutorials/file/dndfiles/

Comment 2

[Tom Zöhner]

This works in Chrome right now and has for quite a while. Also it doesn't make files accessible to any website, since only extension with web_accessible_resources set can access the local file system. A standard file upload wouldn't work here since I want to load the file automatically when a user opens a relevant url (for example when a user opens a file using Firefox from the file manager).

Comment 3

[Kris Maglione [:kmag]]

I don't know why `web_accessible_resources` would have anything to do with this.

We're considering adding support for file: scheme and general filesystem access, but not in a way that will let you access the contents of arbitrary files anywhere in the local filesystem.

Comment 4

[Tom Zöhner]

Thanks for pointing me in the right direction, it is the "Allow access to file URLs" checkbox in chrome which allows accessing arbitrary files on the file system and is right now missing in firefox (it's probably better for security but problematic for chrome extensions depending on it).