Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I tried this question on programmers site with no luck

Do you see any reason to block a local html file from accessing another local files located in the same folder?

I mean, if a user downloaded an html app (consisting of several html files) and opened it in her browser, why would she want to block this local app from accessing another files in the same folder? Traditional desktop apps have much broader access rights. Normally users won't save html files and open them in a browser. Why block local access?

share|improve this question
add comment

1 Answer

The actual rules of which files a local html file may access are browser depended. Chrome is a lot stricter than other browsers. Firefox allows access to files in the same folder and down the folder hierarchy as far as I remember.

Ordinary people with little in-depth background knowledge may save a html file with a cooking recipe, a book extract, a travel guide, etc. to their home folder. They don't except such a document to be dangerous. Keeping that in mind, it seems sane, to prevent saved .html files from accessing other local files.

To quote someone on the referenced bug report:

who cares if a webpage can read your credit card numbers by blinding guessing filenames in your profile directory, it can't actually do anything with them if access to internet resources is properly restricted.

The condition in the "if" part is not met: The same origin policy does not apply to image files and scripts loaded via the script tag, to name just two examples. So a locally running JavaScript can leak information to a server on the internet by encoding it in an URL.

Especially saving to the home folder is problematic, because at - least on unix systems - there are well known files with sensitive information such as: mbox, .gnupg/secring.gpg, .ssh/id_rsa, .ssh/id_rsa.pub.

Providing an installationless local http server is a workaround for this issue.

share|improve this answer
    
+1. An even more common scenario is installation media, including e.g. a readme.html file. –  AviD May 11 '11 at 21:30
    
Seems reasonable. What the standard says? –  Vanuan May 12 '11 at 7:05
    
@Vanuan, what standard? (It's the web. There is no standard governing this. It is up to browser vendors to do something sane to protect their users.) –  D.W. May 12 '11 at 8:18
    
@D.W. The same origin policy policy standard or something like that. –  Vanuan May 12 '11 at 11:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.