Adding FTP related protocols to the registerProtocolHandler safelist.

[asankah]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: Add FTP related protocols to the registerProtocolHandler safelist.
• Specification or proposal URL: Add FTP related protocols to the registerProtocolHandler safelist. whatwg/html#6583
• Caniuse.com URL (optional):
• Bugzilla URL (optional): https://bugzilla.mozilla.org/show_bug.cgi?id=1705202
• Mozillians who can provide input (optional):

Other information

TL;DR: We'd like to add ftp, ftps, sftp to the safelist of protocols for which sites can register themselves as handlers.

Spec PR: whatwg/html#6584

[annevk]

This seems fine (i.e., worth prototyping). @valenting thoughts?

[valenting]

I've been wondering if we need to pay special attention to any credentials included in the FTP URL and if that has any influence on whether it's OK to pass them to a protocol handler.
But otherwise it seems OK to me.

[asankah]

@valenting Good point. My reading of https://html.spec.whatwg.org/multipage/system-state.html#security-and-privacy, specifically the Leaking Private Data and Leaking Credentials paragraphs is that embedded credentials would need to be stripped prior to redirection. While the UA can't do this for any custom scheme, we could do this for ftp/ftps/sftp.

I can make it a part of the WPTs.

WDYT?

[valenting]

While the UA can't do this for any custom scheme, we could do this for ftp/ftps/sftp.

Sounds good! Thanks!