Yes. This will likely change in the future (going more in the XSS exceptions way), but I had to cut some UX corners to rush out a prototype because the attack will be publicized at the Usenix conference which starts today.
Let's keep it this way for now, as I said the UI is likely to change for the better soon.
Code: Select all
"cap_x-load": {
"message": "x-load",
"description": "Capability for file:// documents to load subresources from a different and non descendant directory."
},The problem with this capability (and the reason why I added the description, which is not there for any other string so far), is that it's related to a new mitigation for a specific non-disclosed yet fingerprinting issue, and it's the first (and hopefully last) of a new kind of "floating" capabilities, which are displayed only for specific origins (in this case only for file:/// URLs) and circumstances (in this case when a subresource load from a path which is not the same of the hosting document is attempted).fatboy wrote: ↑Mon Apr 21, 2025 8:51 amlooked at https://gitlab.torproject.org/tpo/appli ... sues/43635 , but I don't understand.Code: Select all
"cap_x-load": { "message": "x-load", "description": "Capability for file:// documents to load subresources from a different and non descendant directory." },
This can be seen in tor 13.5 (or only in 14), r3dfox 128, Fx 115?
More like if you open "file:///home/fatboy/Downloads/somepage.html" and it tries to load anything, even an image, from an unrelated directory (e.g. "file:///home/fatboy/.config/chromium/Avatars/avatar_generic.png"), then a "x-load" placeholder is shown, and also in the permissions popup you get a CUSTOM line for file:///home/fatboy/.config/chromium/Avatars/ entry with the "x-load" checkbox first in the customization interface. No tooltip yet, though; "description" in messages.json files are just meant as an explainer for translator, AFAIK. I will need to add extra "cap_xxx_tooltip" entries (or something like that) with messages like "If granted, this capability allows files in this directory to be loaded by any other file:/// document".
Tried to update the sticky with this information, is it correct?Giorgio Maone wrote: ↑Mon Apr 21, 2025 11:08 amMore like if you open "file:///home/fatboy/Downloads/somepage.html" and it tries to load anything, even an image, from an unrelated directory (e.g. "file:///home/fatboy/.config/chromium/Avatars/avatar_generic.png"), then a "x-load" placeholder is shown, and also in the permissions popup you get a CUSTOM line for file:///home/fatboy/.config/chromium/Avatars/ entry with the "x-load" checkbox first in the customization interface. No tooltip yet, though; "description" in messages.json files are just meant as an explainer for translator, AFAIK. I will need to add extra "cap_xxx_tooltip" entries (or something like that) with messages like "If granted, this capability allows files in this directory to be loaded by any other file:/// document".