Closed
Bug 405976
Opened 18 years ago
Closed 18 years ago
XMLHttpRequest in a local file can open any local file
Categories
(Firefox :: Security, defect)
Tracking
()
RESOLVED
INVALID
People
(Reporter: guninski, Unassigned)
Details
Attachments
(1 file)
|
405 bytes,
text/html
|
Details |
XMLHttpRequest in a local file can open any local file, bypassing file restrictions on trunk.
this allows at least reading xml files (branch can easily read 'text/plain')
done via the normal usage of XMLHttpRequest
|
Reporter | |
Comment 1•18 years ago
|
||
open it locally
|
|
Reporter | |
Comment 2•18 years ago
|
||
hm, i am not sure reading xml files is easily possible: even well formed xml files produce error in js console.
this may be invalid, though it is kinda strange doing the xml request.
|
|
Reporter | |
Comment 3•18 years ago
|
||
probably this is invalid
|
||
Comment 4•18 years ago
|
||
It's able to read my /etc/passwd if I have security.fileuri.origin_policy=3, but with security.fileuri.origin_policy=2 (the current default), it gets an empty responseText and a strange error message.
Group: security
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → INVALID
You need to log in
before you can comment on or make changes to this bug.
Description
•