836730 - Plugin whitelisting does not work for local files

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P3)

Description

[Ivo Anjo]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130125235454

Steps to reproduce:

Visit the website
http://docs.oracle.com/javase/tutorial/uiswing/examples/components/TumbleItemProject/src/components/TumbleItem.html
with the Java plugin installed. (The applet file itself is currently 404 but that doesn't make a difference for the test.)

Firefox presents the click-to-play box, and if you press it the Java gets loaded and then gives an error (but is loaded).

Now if instead you press the plugin button on the firefox address bar, you get an option Activate All Plugins > Always activate plugins for this site. If you use it, and then refresh, next time you visit the site the Java plugin is automatically started.

So far so good.

The bug is: Save the page to your local machine, and open it with firefox. Then try to whitelist the Java plugin. It does not work.


Actual results:

Files on the local machine which trigger plugins cannot be added to the plugin whitelist.


Expected results:

Local files should be able to be whitelisted.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Well, the approach in bug 802544 (this exact problem but on Android) was to remove the option to whitelist file:// uris. I don't think that was a good solution, so I'll have a look into what we can do here.

Comment 2

[Ivo Anjo]

Indeed, I hope this is not removed otherwise it will completely break things like "Wiki on a Stick" and "TiddlyWiki", and also locally testing stuff that uses a plug-in will be a pain.

Could the host be set as 127.0.0.1 when a file:// uri is used, or something similar?

Comment 3

[Benjamin Smedberg]

I don't know yet whether this will be fixed by removing the option for file: URIs or making them work somehow... the abilities of the permission manager may determine what we can do here. But we should probably fix this one way or another.

Comment 4

[Ivo Anjo]

Another option would be to add an about:config option for local files. This way advanced users could still toggle it when needed, even if the GUI did not allow it.

Comment 6

[Dana Keeler (she/her) [:keeler]]

From what I can see, this was fixed by bug 815640 (albeit on a file-by-file basis, as I understand it).

Comment 7

[Paul Silaghi, QA [:pauly]]

Verified fixed in nightly 2013-03-05