Return to Answer

This is a reasonable question to ask, because it's not immediately apparent why merely opening arbitrary file URLs is bad in the same way that reading arbitrary file URLs is bad. Here's the short answer:

So, to summarize:

• Local files have greater privileges than remote files, so allowing remote Javascript to open local Javascript can allow for privilege escalation.

• Browsers don't always perfectly enforce the same-origin policy, and bugs in the same-origin policy can allow arbitrary file access if all file:// URLs are considered to have the same origin.

• Some file:// URLs can cause malicious effects just by allowing the browser to open them.

This is a reasonable question to ask, because it's not immediately apparent why merely letting websites open arbitrary file URLs is bad in the same way that letting websites read arbitrary file URLs is bad. Here's a summary:

• A malicious website can read arbitrary files on disk by opening a file:// URL if the file:// URL points to a malicious HTML file on disk. Browsers and other applications sometimes cache untrusted HTML as a file on disk.

• Browsers don't always perfectly enforce the same-origin policy, and bugs in the same-origin policy can allow arbitrary file access if all file:// URLs are considered to have the same origin.

• Some file:// URLs can cause malicious effects just by allowing the browser to open them.

Here's the long-winded explanation with quoted sources:

Steps to reproduce:

Visit an remote (http) webpage:

location="intent:file:///(path)#Intent;type=text/html;end";

Actual results:

The JS code above redirects the user to file: URL.

The redirection allows remote pages to exfiltrate files in /sdcard/Download/.

As an example, on Unix systems, clicking a link like <A HREF="file:///dev/zero"> will cause the browser to start writing an infinitely large file of zeros. There are similar problems on Windows.

Steps to reproduce:

Visit an remote (http) webpage:

<script>
location="intent:file:///(path)#Intent;type=text/html;end";
</script>

Actual results:

The JS code above redirects the user to file: URL.

The redirection allows remote pages to exfiltrate files in /sdcard/Download/.

As an example, on Unix systems, clicking a link like <A HREF="file:///dev/zero"> will cause the browser to start writing an infinitely large file of zeros. There are similar problems on Windows.

This is a reasonable question to ask, because it's not immediately apparent why merely opening arbitrary file URLs is bad in the same way that reading arbitrary file URLs is. Here's the short answer:

• Local files have greater privileges than remote files, so allowing remote Javascript to open local Javascript can allow for privilege escalation.

• Browsers don't always perfectly enforce the same-origin policy, and bug in the same-origin policy become worse

• Some file:// URLs can cause malicious effects just by the browser opening them.

This is a reasonable question to ask, because it's not immediately apparent why merely opening arbitrary file URLs is bad in the same way that reading arbitrary file URLs is bad. Here's the short answer:

• Local files have greater privileges than remote files, so allowing remote Javascript to open local Javascript can allow for privilege escalation.

• Browsers don't always perfectly enforce the same-origin policy, and bugs in the same-origin policy can allow arbitrary file access if all file:// URLs are considered to have the same origin.

• Some file:// URLs can cause malicious effects just by allowing the browser to open them.