Hacker News Reader

How does HTTP(S) Same Origin policy work with local file:/// URLs?

TIL there's no `ls -al /usr/share/man/** | man --html`; though it would be easy to build one with Python's http.server, or bottlepy, or bash,.

Prompt: An http server ( with bash and /dev/tcp/ ) that serves HTML versions of local manpages with linkification of URLs and references to other manpages

View on HN

> How does HTTP(S) Same Origin policy work with local file:/// URLs?

It doesn't since file:/// is just a uri and not part of the http protocol

If I open an HTML copy of a manpage that contains JS from a file:/// URL, can it read other local files and send them to another server with img URLs?

If so, Isn't it thus probably better to run an HTTP server over a permissioned socket than to serve static HTML [manpages] from file URLs [in a [DEB] package]?

file:/// is always going to be local to the machine reading the URI. So if you're serving a page that has a file:/// uri in it and someone on another machine clicks on it, they wont be seeing the file (unless they happen to have the same path on their machine). If the goal is get them that file, then yes, it'll need to be served.

CVE-2019-11730: https://nvd.nist.gov/vuln/detail/CVE-2019-11730

https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

Reply on news.ycombinator.com