Disallowing file URLs

[iherman]

(This is a spin-off of a discussion in #2266, also raised during the discussion with @GJFR at the EPUB meeting; raising it as a separate issue for a better tracking)

At the moment, the only reference to file: URLs in the spec is a SHOULD NOT for the href attribute in the package file. These urls are obvious security issues for content documents that are supposed to be 'installed' in various places, and there is no reason to use them. The proposal is to explicitly disallow their usage in EPUB.

[iherman]

The issue was discussed in a meeting on 2022-06-09

List of resolutions:

• Resolution No. 1: Remove file URLs, merge PR 2329 and close issue 2324.

View the transcript

1. Disallowing File URLs.

See github issue epub-specs#2324.

See github pull request epub-specs#2329.

Dave Cramer: I can't think of good reason to have these, but a lot of good reasons to prohibit them.

Brady Duga: yes, sounds good. File URLs seem to be interoperable. What file would you load from an epub?.

Ben Schroeter: most common thing i've seen is youtube videos, but those aren't file URLs, right?.

Brady Duga: depends on how the epub is created. Could be a link to youtube, or link to external resource that plays in your epub, but neither of those are file URLs.

Dave Cramer: file URL goes against idea that epub should be self contained, you don't want epub author to look at your files in your local machine.

Ben Schroeter: when Play gets file URL what happens?.

Brady Duga: probably gets stripped on the server, but probably gets intercepted and rejected. We might try to open it in the browser, but then the browser would probably reject it.
… there are also a lot of origin issues with file URLs.

Dave Cramer: I propose we forbid file URLs.

Brady Duga: there's already a PR open for that.

Proposed resolution: Remove file URLs, merge PR 2329 and close issue 2324. (Wendy Reid)

Ben Schroeter: +1.

Dave Cramer: +1.

Brady Duga: +1.

Masakazu Kitahara: +1.

Wendy Reid: +1.

Matthew Chan: +1.

Matt Garrish: +1.

Ben Schroeter: +1.

Toshiaki Koike: +1.

Resolution #1: Remove file URLs, merge PR 2329 and close issue 2324.