1405384 - Can't load file:// path

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect)

Description

[Jonathan Kingston [:jkt] he/him]

I'm getting an issue loading file paths in Nightly:

STR:

1. Drag file to be in a tab
2. File stays as a blank page

Manually copying and pasting the URL into a new tab doesn't help either.

Following error:
Security Error: Content at moz-nullprincipal:{<hash>} may not load or link to file:///C:/<filePath>.

Comment 1

[Daniel Veditz [:dveditz]]

Huh... we recently fixed a problem where people could drag a file link from a page (which isn't allowed to open it) to a new tab, and we wanted to stop that because it was a "social engineering" attack vector. Maybe we went too far on windows, or links from outside the browser aren't given an appropriate origin?

Hiding for now because I don't know if the other bug is public (need to find and add link).

Comment 2

[:Gijs (back August 25; he/him)]

Maybe bug 1379842 caused this? Jonathan, can you test if backing out that change fixes this?

Comment 3

[Tooru Fujisawa [:arai] (away until 08-17)]

(In reply to Jonathan Kingston [:jkt] from comment #0)
> 1. Drag file to be in a tab

what's the detail of this tab?
which URL does this tab contain before drag?
and which actual UI part do you drag file onto? (certain tab or tab bar or content area?)


> 2. File stays as a blank page

what does this mean?

Comment 4

[Tooru Fujisawa [:arai] (away until 08-17)]

so far, I can open file by dragging onto:
  * tab in tab bar
  * empty space of tab bar (for this case I refer current tab)
  * content area
when the tab contains:
  * about:blank
  * https://bugzilla.mozilla.org/
  * another file:/// file
  * about:newtab
on 58.0a1 (2017-10-03) (64-bit) with e10s, clean profile, on macOS.

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

I tried dragging and dropping local files on Linux (using latest from mozilla-central) - that all works for me on Linux. Probably it's really Windows specific, since Jonathan also filed the bug to be Windows specific.

Comment 6

[Jonathan Kingston [:jkt] he/him]

I can't reproduce this any more with todays build. I didn't have access to the bug that Gijs mentioned but it sounds like I didn't have the patch that Dan mentions.

So opening a new tab or dragging a file to the tab strip both produced a white page and never loaded.

I'm going to mark as fixed, will reopen if I see it again.

Thanks