User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2 Iceweasel/6.0.2 Build ID: 20110906070925 Steps to reproduce: 1. Run firefox on the local machine A. 2. Connect to a remote machine B. 3. Run "firefox file:///path/to/file" or "firefox file://host_B/path/to/file". Actual results: /path/to/file from machine A is opened (if it exists). Expected results: /path/to/file from machine B should be opened or Firefox should display a clear message saying that this is not implemented.
Raising to major as this can be a security problem (e.g. a file with sensitive information could be displayed, perhaps other unknown consequences...). Local files should be opened only at an explicit user request.
I'm 99.99% sure that there's an existing bug on file:// URIs not supporting hostnames in necko...
There's bug 70871, but it is different. Bug 70871 is about accessing remote file://host/ URL's, while this bug is about accessing file:// URL's, where the host part is empty or localhost and any other hostname of the local machine (i.e. the machine from which the command is invoked). This bug can be partly seen as a consequence of bug 70871 due to the fact that the invoked firefox connect to a remote firefox. But this bug might also be fixed without fixing bug 70871 (e.g. by avoiding the connection to the other running firefox).