257544 - Allow protocol configuration for local pages.

Status: RESOLVED WONTFIX

(Core :: Networking, enhancement)

Description

[Adam Bryzak]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3

In local pages, allow the user to customise what protocols they want to enable,
for example, the shell: protocol.

Reproducible: Always
Steps to Reproduce:
1.Create a local website
2.Add a link for the shell protocol (eg. shell:windows\system32\calc.exe
3.Try using the link

Actual Results:  
The link did not work.

Expected Results:  
Ask the user if they would like to execute the link.

Comment 1

[timeless]

yes please, i want to use the next cache exploit to do privilege escalation.

Comment 2

[Daniel Veditz [:dveditz]]

Asking is wrong (as timeless points out), but a separate configuration option
that could be manually set to allow protocols if needed for intranet use would
be better than having to open the protocol to any random site. Something along
the lines of the capability policies perhaps?

OS: all, confirming... but it's an enhancement that no one's going to rush out
to do.

Firefox is wrong, this would be a core change