RequestPolicy/requestpolicy — Issue #59: all file:// urls are treated as different origins/destinations
Author: jsamuel
Created: 2011-12-22 18:49:17+00:00
State: open
Labels: extension

imported trac ticket
created: 2009-12-02 08:46:39
reporter: justin

As of 0.5.12, file:// urls cannot be whitelisted in any other way than whitelisting a complete url. This behavior appears to have changed between 0.5.8 and 0.5.12 and has been reported by at least one user.

Right now, if you open a local file that relies on other local files, for example in the same directory, every other local file the page accesses will be a different item in the menu under blocked items. The way to get all content allowed is to allow all requests from the origin url. This isn't a nice solution if there is a mix of local and non-local content and one only wants to allow the local content.

We need to figure out what the best behavior here is. Possibly the most important thing to consider is just the "file://" protocol itself (I believe this was the previous behavior). It would be good for security, though, to be able to have more fine-grained control, probably on a per-directory level. That is, if someone saves a file and then opens it locally, maybe they don't want it to be able to access files outside of the directory its running from.

One problem with breaking it down by directory is that the menu can't display many characters, so either the beginning, middle, or end of the url in the menu will be truncated, which isn't very helpful in some cases.