On Fri, Jun 27, 2014 at 4:56 PM, Michal Zalewski <lcamtuf@coredump.cx> wrote: > >> I think the inclusion of file:/// is somewhat problematic, since it is > >> not implied that the content arrived over a secure channel, > > > > Right. "But it's here now." Perhaps we should take file: off the list, > > perhaps we should find some way to tag files as having come from > > secure transport, or... > > A special problem here is also how to scope the permission if ever > granted by the user. A permission granted to > file:///installed_app/bar.html probably shouldn't carry over to > file:///some/random/downloaded/thing.html. I believe in Chrome, at least for content settings and similar origin-scoped permissions, file: URLs are treated as if the entire file path is the origin, so every file's permissions are unique to it. I haven't checked this against the code. PK
Received on Saturday, 28 June 2014 00:04:29 UTC