427427 - <img src=file://nul ........... >

Status: RESOLVED WONTFIX

(Toolkit Graveyard :: Error Console, enhancement)

Description

[Mike]

User-Agent:       Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Build Identifier: 

I'm using some kind of a filtering proxy, and
one (among others) thing it does is to disable specific images.
In particular, it turns them into:
<img src=file://nul
   ........... >
The Mozilla generates a "security warning" for these tags,
stating the target doen't exist.
(And it adds "/." to the path. Why?)
Don't check for the file existance, just open it & catch errors,
if any!


Reproducible: Always

Comment 1

[Matthias Versen [:Matti]]

the security error should tell you all, remote content isn't allowed to link to local content

Comment 2

[Mike]

Ok on your explanation, Matthias.
But why does Firefox add "/.", and does say "not found" warning
instead of the "access denied"?
There's something to fix anyway, I believe.

Comment 3

[Matthias Versen [:Matti]]

what is the full error message, you can copy it from the error console.
the file syntax is file://server/path_to/file.

You didn't add a version of the used product as you have to do.

Comment 4

[Matthias Versen [:Matti]]

Attachment: testcase

Comment 5

[Matthias Versen [:Matti]]

using the error message i get :
Security Error: Content at https://bugzilla.mozilla.org/attachment.cgi?id=314820 may not load or link to file://nul/.

the /. is added because file://nul doesn't link to a file, just to a server and the next link to a file would be file://nul/.
The "." is the . between "filename.extension" i would guess.

Comment 6

[Matthias Versen [:Matti]]

Attachment: Testcase with file:///

You get the correct error message with a correct link to a file:
Security Error: Content at http://server600/test.html may not load or link to file:///nul.

The point is again from the extension because you try to link to a nul. file.
(you can not link to devices)

Comment 7

[Mike]

Thank you, Matti, for showing me the significance of
"file:///"; I knew nothing of it before.

You said I can't link to device.
But I think developers can make a few safe exclusions
from this rule, for the "nul" device in particular.
That's why a turned all the stuff to "enhancement" status.

Sure, the conversation is over.

Comment 8

[Mike]

Sorry, i did a misspelling.
Please read as following:

That's why i turned all the stuff to "enhancement" status.

Comment 9

[Matthias Versen [:Matti]]

You can not only link to devicenames, you can also not link from http:// to file:// URLs. That's why you get a this security error. You can't for example change the link file://nul to a valid 1x1 pixel valid image on your hdd (file:///image.gif ) because you would also get this security error.
I would in your case use my local http server for that or use a image from my router interface and set the size to 1x1 pixel (via proxy).

Allowing linking to local files and also to devicenames is wontfix, sorry