475517 - use video from file:// on page

Status: RESOLVED INCOMPLETE

(Core :: Audio/Video, defect)

Description

[Jan Gerber]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2a1pre) Gecko/20090126 Minefield/3.2a1pre
Build Identifier: 

the new security policy that prevents me from rendering a frame of a video from file:// that is opened on a webpage into a canvas should not prevent the rendering but just accessing the data. displaying a frame from the video inside of a canvas element is not a security issue, sending to to the server might be.


Reproducible: Always

Steps to Reproduce:
download video http://pad.ma/Vt89jdgt/download
download offline page: http://pad.ma/Vt89jdgt/offline

rename offline page so that they are both in one folder:
video.ogv
video.html

open html page in firefox and click on link.
now the local video is used on pad.ma.

access that is required is:
* setting and getting currentTime for seeking and displaying the current position
* rendering a frame to a canvas element to display in and out points.

Comment 1

[Jesse Ruderman]

For web pages on http: trying to access videos on file: -- it would be really hard to allow sites to display frames from the video without also letting them see those frames and learn about the file's existence, dimensions, duration, etc.  See bug 451938 and bug 451958.

For both the web page and video being in the same local directory -- the page should have complete access to the video file.  It can XHR the video file, after all ;)

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We definitely cannot allow http: pages to load file: videos, for the same reasons we do not allow http: pages to load file: images.

I'm not sure if this bug is requesting that, or something else. A file: HTML page loading a file: video in the same directory definitely does work.

Comment 3

[Biju]

or is it a case of Bug 481559

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It's not really clear what this bug is requesting. The possible interpretations either already work or must not be permitted.