4 ms·

Related: Firefox will restrict the behavior of loading scripts and assets via file:// from other file:// scripts. See https://stackoverflow.com/questions/58067

Related: Firefox will restrict the behavior of loading scripts and assets via file:// from other file:// scripts. See https://stackoverflow.com/questions/58067499/runing-javascript-in-local-html-files-in-firefox https://stackoverflow.com/questions/58067499/runing-javascri..., and I think there is another flag you need to disable as well. Why is that? I definitely get blocking file:// scripts from any other protocol, and even blocking file:// scripts outside of the webpage's directory. But if you can get a user to open a webpage on their local machine, in the same folder as sensitive data, you mine as well just get them to run an arbitrary program.

esprehn 4y ago
In general that's not true. Folks save web pages to their desktop or downloads folder all the time, when opening a saved Wikipedia .html file people don't assume it can then read every other file on your desktop. Worse would be if you saved it to your Documents or ~. Web pages are assumed to be "safe" by users, like a pdf or a png.
- Aeolun 4y ago
  Safe like a PDF is probably a good equivalent :)
  - deleted 4y ago
    [deleted]
- egberts1 4y ago
  Please consult CVE for numerous citations on PDF file. Furthermore, PDF also runs JavaScript, their Kind of JavaScript, depending on where you downloaded it from.
  - saurik 4y ago
    An exploit in the renderer isn't the same as supported dangerous behavior.
  - tgsovlerkhgsel 4y ago
    https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... is the only case in the past few years that I'm aware of where a PDF vulnerability was actually exploited before it was widely patched, and that was a highly targeted attack. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reader https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reade... shows 4 potentially exploitable vulnerabilities + 1 that lets the attacker check if a file exists. I couldn't find any semi-recent ones affecting Firefox' PDF.js.
deleted 4y ago
[deleted]
tgsovlerkhgsel 4y ago
~/Downloads/ typically contains both the random downloaded web page the user just opened, and the user's bank statements.
deleted 4y ago
[deleted]

esprehn 4y ago

In general that's not true. Folks save web pages to their desktop or downloads folder all the time, when opening a saved Wikipedia .html file people don't assume it can then read every other file on your desktop. Worse would be if you saved it to your Documents or ~. Web pages are assumed to be "safe" by users, like a pdf or a png.

Aeolun 4y ago
Safe like a PDF is probably a good equivalent :)
- deleted 4y ago
  [deleted]
egberts1 4y ago
Please consult CVE for numerous citations on PDF file. Furthermore, PDF also runs JavaScript, their Kind of JavaScript, depending on where you downloaded it from.
- saurik 4y ago
  An exploit in the renderer isn't the same as supported dangerous behavior.
- tgsovlerkhgsel 4y ago
  https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... is the only case in the past few years that I'm aware of where a PDF vulnerability was actually exploited before it was widely patched, and that was a highly targeted attack. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reader https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=adobe+reade... shows 4 potentially exploitable vulnerabilities + 1 that lets the attacker check if a file exists. I couldn't find any semi-recent ones affecting Firefox' PDF.js.

deleted 4y ago

[deleted]

tgsovlerkhgsel 4y ago

~/Downloads/ typically contains both the random downloaded web page the user just opened, and the user's bank statements.

deleted 4y ago

[deleted]