Similarly, the Enable Local File Links extension simply adds a click event listener to every page loaded in the browser. JavaScript that calls =”file://whatever”). It also wouldn’t fix up any non-link file navigations (e.g. file-after-prompt://) that will launch a confirmation dialog before opening the targeted URL via ShellExecute or explorer /select,”file://whatever”, but this would entail the extension running on every page, which has non-zero performance implications.
One could write an extension that uses a Content Script to rewrite all file:// hyperlinks to an Application Protocol handler (e.g. Unfortunately, the extension API chrome.webNavigation.onBeforeNavigate does not fire for file:// links that are blocked in HTTP/HTTPS pages, which makes working around this blocking via an extension difficult. Like legacy IE itself, IE mode pages in the Intranet zone can navigate to file urls. Workaround: IE ModeĮnterprise administrators can configure sites that must navigate to file:// urls to open in IE mode. The Same Origin Policy for file URLs is poorly defined and inconsistent across browsers, which can result in security problems. Navigating to a local file might result in that file opening in a handler application in a dangerous or unexpected way. Pulling remote resources over file:// can leak your user account information and a hash of your password to the remote site. What makes this extra horrific is that if you log into Windows using an MSA account, the bad guy gets both your global userinfo AND a hash he can try to crack.īeyond the data leakage risks related to remote file retrieval, other vulnerabilities related to opening local files also exist. The most obvious problem is that the way file:// retrieves content can result in privacy and security problems. No option to disable this navigation blocking is available in Chrome or Edge 76+, but ( UPDATE) a Group Policy IntranetFileLinksEnabled was added to Edge 95+. In contrast, Edge18 (like Internet Explorer before it) allowed pages in your Intranet Zone to navigate to URLs that use the file:// url protocol only pages in the Internet Zone were blocked from such navigations 1. If you open the Developer Tools console, you’ll see a note: “ Not allowed to load local resource: file://host/whatever”. If a browser user clicks on a file:// link on an https-delivered webpage, nothing visibly happens. For security reasons, Microsoft Edge 76+ and Chrome impose a number of restrictions on file://URLs, including forbidding navigation to file:// URLs from non-file:// URLs.
0 kommentar(er)
