1456480 - WebExtension file access

Status: RESOLVED DUPLICATE of bug 1246236

(WebExtensions :: General, defect)

Description

[Michael]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20180323154952

Steps to reproduce:

Years ago we developed an addon for our customers to conveniently download, modify and afterwards upload these modified documents (text files, excel sheets, ...) to our website. We re-developed this addon; using the new WebExtension API. 

Our WebExtension requests several permissions from the client:

"permissions": [
        "downloads",
        "downloads.open",
        "webRequest",
        "webRequestBlocking",
        "storage",
        "tabs",
        "file:///*"
],


To read local files we used:

fetch('file:///C:\Users\hansenm\Downloads\myFolder\myFile.txt', {mode: 'same-origin'}).then(response => {
            return response.blob()
}).then(fileBlob => {
    // yay!
}).catch(error => {
    // bad luck
});

we got confusing behavior using windows (10 pro) with Firefox 60.0b14.


Actual results:

- When using a path inside the user profile (like above), we got a "TypeError: NetworkError when attempting to fetch resource."

- when we grant the windows "everyone"-group read-access to the file (or the folder the file was located), we were able to read the file again. (in every test case, the user that was logged in and owned the firefox process had full access to the files)

- reading the file using the adressbar (again using file protocol file:///) worked 

- Everything works fine when we tried to read a file from C:\somewhereElse

- Using linux (ubuntu 16.04 LTS) we had no issues accessing any files.


Expected results:

Because I read at least some infos about your file access restriction plans, I don't know if it's a real bug or missing documentation, because I couldn't find any current docs about it.
I just found https://wiki.mozilla.org/WebExtensions/Filesystem which is marked as draft and seems already outdated.

Comment 1

[Gingerbread Man]

Duplicate of bug 1246236?

Comment 2

[Kris Maglione [:kmag]]

In the future, we plan to add a filesystem access API. At the moment, any access extensions have through fetch requests is largely incidental, and unsupported. On Windows, extensions run in a content process, separate from the main browser process, which has some degree of sandboxing. For the moment, we do allow that process to access the filesystem, but I believe it does still drop its user privileges.

Though, as a side note, \ characters are not valid in file: URLs, and the string, as you wrote it, parses as "file:///C:UsershansenmDownloadsmyFoldermyFile.txt".

Comment 3

[Michael]

Do you already have a timetable for the filesystem access API?

Because of privacy/data protection can't set the "everyone"-group on the client systems of our customers. Are there any other solutions to grant an extension read access to local files without showing this file to any other user on the client system?


Thanks for the hint regarding the backslashes!