[whatwg/fetch] Prohibit file: URL access from non-file: URLs (#1195)

https://fetch.spec.whatwg.org/#concept-scheme-fetch says

> For now, unfortunate as it is, file URLs are left as an exercise for the reader.
>
> When in doubt, return a network error.

We could tighten this up a bit by stating that in certain cases, the implementation _must_ return a network error. The most important one being from "web content".

Things that I believe are true:

- HTTP(S) pages cannot retrieve file URLs using any API (subresources, iframes, fetch(), ...)
- Browsers can load file URLs if you navigate to them directly in a top-level browsing context
- File URL pages can load _some_ other file URL resources (some implementations seem to make this depend on directory structure, or have interesting notions of origin which make origin-aware features behave differently)
- blob:, data:, javascript:, and about:blank pages "created from" HTTP(S) URLs cannot load other file URLs

Things that I am not sure on but speculate might be true:

- blob:, data:, javascript:, and about:blank pages "created from" file: URLs can load other file URLs


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1195