file: URLs are problematic from a security standpoint. Modern browsers have added many restrictions on
file: URLs. It isn't just in
file: URLs are blocked as the source for
- XHR (AJAX) calls
The basic vulnerability is that an attacker could grab a sensitive file from the local file system when you visit their web site. Consider the following which without restrictions on the iframe would load login information for many systems:
Iframes are typically sand boxed such that the parent site doesn't have complete access to them. However, sand boxing isn't foolproof and hackers have found certain cases that allow them to get around it.
Another vulnerability is forcing the user of a website to download a malicious file (usually HTML, PDF, or DOC) and then using an iframe with a
file: URL to execute that file from the local downloads directory. In older browsers when that happens, the malicious file runs with full access to the local file system.
To combat these problems modern browsers have:
- Restricted live sites from using embedding
file: URLs as described above
- Restricted live sites frome even linking to
file: URLs. Now when you click on a link to a
file: URL, nothing happens and an error message appears in the developer console.
- Restricted locally opened
file: URLs from accessing the entire local system. In some modern browsers, local
If you are trying to develop a website locally most browsers allow you to turn off some of these restrictions so that you can get your work done. Just don't use your browser on live sites with these security restrictions turned off. For example in there are instructions for doing so in Firefox.