Why browsers implement stricter policy for local files

Question

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: https://stackoverflow.com/questions/21408510/chrome-cant-load-web-worker. In the end, I have to go an extra mile to install and run a websever on my machine so that I can properly view website hosted on my own filesystem.

However, I don't understand the reasoning. Why does the browser implement stricter policy for local files? Aren't files already on my disk more trustworthy than those loaded from remote sites?

Answer 1

Aren't files already on my disk more trustworthy than those loaded from remote sites?

No.

Expected local HTML use case for normal (ie non-developer) users is they've gone to a web page, wanted to view it offline, and used the browser's Save As functionality to make a local copy. This does not imply any level of trust between the user and the operator of the site hosting that page and should not, in general, give that operator access to read other files from the user's hard disc.

In days of old, IE used to grant greater permissions to HTML on the local filesystem. The upshot was a ton of security holes, in that any application that could be persuaded to save a file containing HTML to a predictable path could typically be exploited to execute attacker code.

Answer 2

In Firefox you may manually edit prefs.js file adding:

user_pref("capability.policy.policynames", "localfilelinks");
user_pref("capability.policy.localfilelinks.sites", "http://localhost:8080");
user_pref("capability.policy.localfilelinks.checkloaduri.enabled", "allAccess");

Notice the need for explicit port specification if different from 80.

Answer 3

If some information is available on the web to anyone, with no special credentials required, there's generally no need for a browser to worry about safeguarding that information. Anyone who would want the information could likely get it more easily by simply asking for it, than by trying to exploit a security weakness in someone's browser.

The reason browsers are much more cautious with local files than with files received from the web is not that the former are more likely to be malicious, but rather that the former need to be guarded against unauthorized disclosure while the latter do not.