402144 - web-based content handlers could leak secure URIs

Status: NEW

(Firefox :: File Handling, defect)

Description

[Dan Mosedale (:dmosedale, :dmose)]

Section 4.5.1.1 of the current draft of WhatWG sez:

Leaking secure URIs. User agents should not send HTTPS URIs to third-party sites registered as content handlers, in the same way that user agents do not send Referer headers from secure sites to third-party sites.

When I asked Hixie about the rationale for this, he referred me to the paragraphs above it about leaking intranet URIs.  Note that he didn't really know what the exact rationale for the Referer stuff was.  I presume the theory is that if you care enough to encrypt a site, than you probably want its contents kept private.  Not crazy, but that's an awfully large hammer for this nail.

My inclination is to not implement this restriction, but I'm conflicted about this.  Alternate ideas encouraged...

Comment 1

[Jesse Ruderman]

This only applies to web-based *content* handlers, not web-based *protocol* handlers, right?

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

You're totally right.

Comment 3

[Jesse Ruderman]

Is this going to be an issue for feeds (due to feed:https: or feed mime types) in Firefox 3?

Comment 4

[Boris Zbarsky [:bzbarsky]]

> in the same way that user agents do not send Referer headers from secure sites
> to third-party sites.

This is because said URIs often contain the entire contents of a form (HTTP GET and all), and hence contain information that the user and site may not want to broadcast, possibly including authentication information (e.g. username).

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

(In reply to comment #3)
> Is this going to be an issue for feeds (due to feed:https: or feed mime types)
> in Firefox 3?
> 

It's probably already an issue for feeds due to the MIME types.