Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 3 down vote favorite

The question is based on this issue in Chromium. It is marked as Won't Fix.

Do you see any reason to block a local html file from accessing another local html file located in the same folder?

share|improve this question
18  
On the contrary, I don't see any reason to allow it. – sevenseacat Apr 29 '11 at 13:59
What about a local webapp or an extension? Is it forced to store all its data in a single long html file? – Vanuan Apr 29 '11 at 15:01
1  
@Karpie I agree with your basic theory, but at the same time disagree with the realistic application. There is a marked difference between academic and applied and, in this case, the suggested workarounds (ie., setting up another server, using security-disabling flags, etc.) seem worse than having an established model where "File in X directory has read permissions on other files in X directory". Perfect? No. Better than kludgy alternatives? Maybe? The example case of "many applications are using HTML help docs" seems a reasonable real-world scenario. – Farray May 4 '11 at 9:20
If you want, you can try this over at security.stackexchange.com – AviD May 11 '11 at 19:07
@Karpie - you should explain why rather than just tossing in a throw-away like that. Not everyone understands security implications. Educating about what seems to be a fair question would be nice. – quickly_now May 30 '11 at 4:36
show 2 more comments

closed as off topic by maple_shaft♦ Apr 6 '12 at 1:10

Questions on Programmers Stack Exchange are expected to relate to software development within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

3 Answers

up vote 2 down vote

I don't know the real answer, but here's a good guess:

It's common to use File -> Save As... to save HTML to a file. Often users will save HTML files from different web sites to the same directory (perhaps named "Downloads"). Allowing one of these files to access the other (and possibly upload it somewhere) would be a privacy leak.

Since there are more users than developers and users are less security-aware on average, protecting users probably seems more important.

Even without this feature, it's still possible to create web applications that work offline. See: http://diveintohtml5.org/offline.html

share|improve this answer
up vote 0 down vote

This is fully explained in a post from the Chromium blog.

share|improve this answer
This post explains why they block local file from accessing remote sites and vice versa. It doesn't explain why block a local file from accessing another local file. If they implement the first option, the second attack would be useless since an attacker won't be able to send the sensitive data anywhere. – Vanuan Jun 30 '11 at 11:56
up vote 3 down vote

I know this is an old question, but I didn't see this important fact mentioned anywhere:

Chrome allows you to add a folder on your file system as a local Web application. Once you do that, files in that folder no longer need to be accessed through the file: protocol -- they become accessible through the chrome-extension:// protocol, e.g., chrome-extension://[app_id]/somefile.html. When accessing your files this way, the restrictions on local file access do not apply.

True, you need to write a small, three-line manifest.json file [1] that specifies the name of your application, but if you want to use multiple local files as a local Web application, it makes some sense, security-wise, to require that you use Chrome's extension architecture to indicate clearly what folders on your hard drive should be accessed like Web applications. That way, Chrome can assume that everything else on your hard drive is not a Web application, and lock down permissions on non-app HTML files that get loaded in the browser. The addition of the manifest.json file adds only a few bytes to your folder, and it doesn't get in the way if you want to use your files in some other browser that does allow unfettered file access.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.