89917 - links to file URLs do not work

Status: VERIFIED DUPLICATE of bug 40538

(Core :: Security, defect)

Description

[siemsen]

When I click on a "file:" link, Mozilla does nothing.  It repaints the
link, which indicates that it knows the link is a link.  It doesn't
matter how many slashes follow the "file:" part of the URL.

Typing the "file:" URL into the locator bar works. If I run Netscape 4.76,
clicking on the "file:" URL works.

This bug seems to relate to bug 66194. That bug is for Mozilla
under Windoze. I get the bug under Linux.

Comment 1

[timeless]

actually the problem is that we disallow links from the web to localhost.  The 
other half of the problem is that we don't provide an explanatory dialog.

Reporter: if you have a preference as to which half of this bug we dupe against 
please indicate, otherwise some QA will make the decission (if no decission 
happens in a week I'll try to dupe against the first half which is resolved 
invalid. the second half is probably more useful...)

Comment 2

[benc]

-> file
do you want the link to work or do you want an error message?

Comment 3

[siemsen]

(from the Reporter)

I want file URLs to work, for the reason given in my O'Reilly "HTML" book,
which says something like "File URLs are useful for people who want access
to personal web pages on their local machine".  They they allow me reliable
access my local web pages regardless of the state of my local web server,
network connection(s), or name services.

Why are they not supported?  Some kind of security thing?  If so, can we
have a user-settable preference that blocks access by default but allows
users like me to get their work done?

If file URLs won't be supported by Mozilla, then there should definitely
be an error dialog.  With all due respect to this fantastic browser, I'll
switch to a browser that has this simple, standard, well-documented
functionality.

Comment 4

[siemsen]

(from the Reporter)

I want file URLs to work, for the reason given in my O'Reilly "HTML" book,
which says something like "File URLs are useful for people who want access
to personal web pages on their local machine".  They they allow me reliable
access my local web pages regardless of the state of my local web server,
network connection(s), or name services.

Why are they not supported?  Some kind of security thing?  If so, can we
have a user-settable preference that blocks access by default but allows
users like me to get their work done?

If file URLs won't be supported by Mozilla, then there should definitely
be an error dialog.  With all due respect to this fantastic browser, I'll
switch to a browser that has this simple, standard, well-documented
functionality.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

*** This bug has been marked as a duplicate of 40538 ***

Comment 6

[benc]

To clarify, we disable file URLS's to ANY host (local and remote servers that
the local system can see via file sharing clients) if the URL lives in a
non-file URL. 

Comment 7

[benc]

-> sec:gen
qa=bindu
cleared status whiteboard