The permission automatically given is file:///*

[MHGhandour]

Describe the bug:

Platform:

• Browser: [Chrome, ]
• Browser Version: Brave

Hello,
I noticed when i managed the extension that it has the permission to read file:///* which basically mean it can read all my local files, including my files that contains all my saved passwords.

[Sneezry]

The file:///* permission is not like what you think. Let me explain what the ability this permission grants, and why we need this permission.

First of all, Chrome extension is not like native apps run on your machine - it is not able to read your local files autonomously. If the extension needs to read your local file, these three conditions must meet:

1. You enable file:///* host permission in extension management dashboard (which is diasbled in your screenshot)
2. You must open that local file in the browser
3. You must make the tab active, which opens the local file, and click the extension icon

We need this permission, because some users save the QR image locally, when they need import data with the local QR image file, the extension must need file:///* permission to access the local image.

Though the extension declares file:///* permission, that permission must be granted by the user in extension management dashboard manually. The permision is always disabled by default, this is as designed by Google.

[MHGhandour]

Ok, Thank you for explaining that. i thought that the access did not require me opening the directory in the tab.
Although, for me it was on by default, i disabled it.
i don't know if it is possible to change this directory to something else set by the user, like ~/Pictures for example, Cause this seemed scary at first to me before realizing it's opensource.

Anw, thank you for this extension, it is well needed

[Sneezry]

Did you install this extension before or is this your first time to install it? Did you enable it before? If this permission is enbaled by default, it's a serious security issue to us.

If Google has changed the behaviour, we need change it to an optional permission.

Here's an answer on StackOverflow to prove such a behaviour. I'm not sure if the answer has been out of date.

[Sneezry]

i thought that the access did not require me opening the directory in the tab.

I think it could be possible because Tabs permission could be granted to extensions without declaration.

@mymindstorm file:///* permission seems dangerous to use. Maybe we could ask user to import local images with an file nput controller instead of to scan it with dragging mouse. What do you think?

[MHGhandour]

Did you install this extension before or is this your first time to install it? Did you enable it before? If this permission is enbaled by default, it's a serious security issue to us.

I am using brave, i am not sure if it's the same with google chrome, but yeah it was the first time i install it.

I tried to install chromium also for the first time and had the same issue :

@mymindstorm file:///* permission seems dangerous to use. Maybe we could ask user to import local images with an file nput controller instead of to scan it with dragging mouse. What do you think?

The mouse dragging still work after disabling this access (and i find it a good feature also, it's convenient)

[MHGhandour]

I am using brave, i am not sure if it's the same with google chrome, but yeah it was the first time i install it.

It the same thing on google chrome (for linux) maybe they have changed the behavior

[Sneezry]

Thanks for the confirmation. We will remove this permission in the next release.

[mymindstorm]

file:///* != Allow access to file URLs

[Sneezry]

@mymindstorm my concern is if the user granted the Allow access to file URLs, the extension is possible able to traversal local files - even though activeTab may help, what if the extension opens a local directory in a new tab and the user clicks that tab?

Of course, we won't do that. However, there is still a risk. Some bad guy may change the js code of the extension on user local machine to do this bad thing.

And I don't think backup QR image is a common way. This could be a niche feature at very beginning.

[mymindstorm]

what if the extension opens a local directory in a new tab and the user clicks that tab?

You can't open directories in Chrome, therefore directory traversal is impossible. activeTab only applies when clicking the browser action or a keyboard shortcut. Clicking a tab with a content script does not count.

Some bad guy may change the js code of the extension on user local machine to do this bad thing.

If there is already a virus or attacker on the computer, that is a worse issue. If an attacker can change a random JS file on the hard drive, then they already have full filesystem access. Why go through the trouble of changing someone else's code when they could just directly steal data off the hard drive?

And I don't think backup QR image is a common way. This could be a niche feature at very beginning.

This is a niche feature, but we have had users support it. The feature is behind an obscure setting that provides explicit user consent to allow filesystem access. Even if it did provide full filesystem access, it wouldn't be a major security issue as our code is not malicious.

If an attacker could successfully exfiltrate a file from the user's computer, then it would also be reasonable to say that an attacker could also steal sensitive user data when we load the content script into webpages. Why is filesystem data at risk, but not user secret data when scanning codes?

If you still believe that it is an issue, go ahead and merge your PR. It's still best practice to limit permissions when we can. I will look into submitting a patch to Chromium to disallow extensions from opening file URLs.

[Sneezry]

Local file permission has been removed in the recent code in GitHub. And the change will be available in the next release.