674047 - Teach FileSaver to take URIs as well

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, enhancement)

Description

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

So that you can do

let saver = FileSaver("http://example.com/foo.txt");

Plan is to use CORS here.  This will need a separate security review.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

It is not clear to me how this should work.
We don't have any events for downloading?

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

That's a good question.  After thinking about it, I don't think we need events for downloading.

Conceptually, FileSaver transfers data from "somewhere" to your disk.  I don't think it matters where the data comes from.  Progress events on the writes are enough, I think.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

For cross-origin loads that aren't backed by CORS we don't want to expose the file size though. We might not even want to expose any progress events as that lets you estimate the size using timing attacks :(

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I thought we just weren't going to do cross-origin loads that aren't backed by CORS?

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

bug has no owner and has not moved in ~2 years, closing blocking sec-review bug as incomplete and leaving flag to indicate need to do security work when / if this bug refreshes

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yeah I don't think we're interested in this anymore.