159135 - [RFE] Block browsing of file system through Address/Location bar

Status: NEW

(Core :: Security: CAPS, enhancement)

Description

[amutch]

Mozilla should provide a method to allow Administrators to easily prevent users
from browsing the file system using the Address/Location bar. When used in a
kiosk or other public location, users should not be able to browse to the
underlying file system through the Location/Address bar using methods like:

file:///c:/

Nor should Mozilla display the contents of the file system. If possible, as
error message explaining the block would be helpful but not necessary. This is a
key feature for kiosk and public implementation of Mozilla. Without it, you have
to rely on the security of the underlying file system to protect the computer.
This is doable in Windows 2000/XP but next to impossible with Windows 9x.  

This support is needed for an embedding application built off MFCEmbed (K-Meleon).

Also, see this thread:

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&threadm=dc5551bf.0111022217.3e2a75a%40posting.google.com&rnum=1&prev=/groups%3Fq%3Dandrew%2Bmutch%2Bstoltz%2Bgroup:netscape.public.mozilla.*%26hl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8%26selm%3Ddc5551bf.0111022217.3e2a75a%2540posting.google.com%26rnum%3D1

Comment 1

[Vidar Haarr (not reading bugmail)]

Valid RFE.
Platform/OS -> All

Comment 2

[Boris Zbarsky [:bzbarsky]]

You could just remove the file:// protocol handler....

Comment 3

[amutch]

My preference would be a "preference" or some mechanism that can be easily
invoked by someone like an Administrator who would be configuring the kiosk
setup. We would want to avoid having to put out a customized build just to deal
with this issue.

Comment 4

[Jo Hermans]

*** Bug 166414 has been marked as a duplicate of this bug. ***

Comment 5

[Matthias Versen [:Matti]]

*** Bug 298135 has been marked as a duplicate of this bug. ***

Comment 6

[Netmisha]

(In reply to Vacation Dec 15-31 from comment #2)
> You could just remove the file:// protocol handler....

How can I remove this protocol?