Comment by mprime1
4 years ago
Yes.
If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.
4 years ago
Yes.
If that wasn't the case, then "HTML virus" would be a thing: I send you an HTML file and, if you open it, it read files from your hard drive and uploads them to my server.
I should have clarified - I mean I was wondering if any browsers block fetch to remote URLs from local files
I do vaguely recall encountering some problem I didn't expect when I was making a tool contained in a local html file, but I dont remember which browser I was using at the time
The problem with your scenario is the reading the local files without permission, not the use of the crypto API.
You are right, I'm conflating 2 issues.
I'm pretty sure Brave was blocking window.crypto but can't remember if it was on a file or over plain HTTP
Blocking crypto on https://news.ycombinator.com/item?id=34084526) none of the browsers do that.
1 reply →