NS_ERROR_DOM_BAD_URI on local file using XMLHttpRequest

UNCONFIRMED
Unassigned

Status

()

P5
critical
UNCONFIRMED
10 years ago
8 months ago

People

(Reporter: tmuzzin, Unassigned)

Tracking

1.9.0 Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.2 Safari/525.20.1
Build Identifier: 3.0.4

When trying to access a local file using XMLHttpRequest and the requested file is in a directory above the current directory that is executing the XMLHttpRequest, the error NS_ERROR_DOM_BAD_URI is thrown.

Expected behavior: XMLHttpRequest is able to access the file since it is accessing a local file (file://)

Actual behavior:  NS_ERROR_DOM_BAD_URI is thrown, and local file is not accessed nor executed.

Example code:

var LocalFileLocation = "../myJSON.js";
var getJSONdata = function(fileLocation) {
		var xhReq = new XMLHttpRequest();
		xhReq.open("GET", fileLocation, false);
		xhReq.send(null);
		var json_data = xhReq.responseText;
		TOC_data = eval( "(" + json_data + ")" );
		return TOC_data;
	}

alert(getJSONdata(LocalFileLocation));

Reproducible: Always

Steps to Reproduce:
run XMLHttpRequest that points to a local file in a directory about the current directory (file://)


Actual Results:  
S_ERROR_DOM_BAD_URI is thrown, and local file is not accessed nor executed.

Expected Results:  
XMLHttpRequest is able to access the file since it is accessing a local file (file://)

Example code:

var LocalFileLocation = "../myJSON.js";
var getJSONdata = function(fileLocation) {
		var xhReq = new XMLHttpRequest();
		xhReq.open("GET", fileLocation, false);
		xhReq.send(null);
		var json_data = xhReq.responseText;
		TOC_data = eval( "(" + json_data + ")" );
		return TOC_data;
	}

alert(getJSONdata(LocalFileLocation));
(Reporter)

Updated

10 years ago
Version: unspecified → 3.0 Branch

Comment 1

10 years ago
This problem seriously impacts using Firefox for local content such as application help systems.
I think this is basically the same as bug 397894 if you just substitute XMLHTTPRequest for XSLT when you read that bug and is INVALID for the same reasons as given there i.e. allowing something to read /etc/password etc just because it is running on your disk somewhere is a bad idea.

To confirm...

Any messages in the error console? (tools|error console)?

Does changing the pref "security.fileuri.origin_policy" to 3 fix it for you?

Comment 3

10 years ago
I can reproduce this in Firefox 3.5.1 (on OS X 10.4.11).

Error console says:

Error: uncaught exception: [Exception... "Access to restricted URI denied"  code: "1012" nsresult: "0x805303f4 (NS_ERROR_DOM_BAD_URI)"  location: "file:///blahblahblah/test.html Line: 11"]

and setting security.fileuri.strict_origin_policy to "false" gets rid of the error, allowing the script to run as intended.
Component: Security → DOM: Mozilla Extensions
Product: Firefox → Core
QA Contact: firefox → general
Version: 3.0 Branch → 1.9.0 Branch
Duplicate of this bug: 560488
Component: DOM: Mozilla Extensions → DOM
Product: Core → Core
https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.