1420360 - Is this a bug that get any files by path when you have applied <all_urls> of permissions key?

Status: RESOLVED DUPLICATE of bug 1420296

(WebExtensions :: Untriaged, defect)

Description

[pea3nut]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171112125346

Steps to reproduce:

//In background script
~async function (){
    var response =await fetch(
        "file:///X:/path/to/file.ext",
        {mode:'same-origin'}
    );
    console.log(await response.text());
}();


Actual results:

I can read any file on my computer by fetch API when I know the path and have <all_urls> permission.

see https://stackoverflow.com/questions/42108782/firefox-webextensions-get-local-files-content-by-path

And, It has used in some extensions. e.g. https://github.com/openstyles/stylus/blob/master/js/messaging.js#L382


Expected results:

It a feature? or a bug?