On my linux computer I export my bookmarks to an html file and use that
for my home page. Easy to just search for what I know is there. I
wanted to do the same thing with FF120/Android.

I finally found a way to copy the file from my computer to the
DCIM/Camera file that holds my photos (from which I FTB them to my
computer via wifi) using the native Pixel 'files' utility. I also
exported it to dropbox and downloaded it to the Pixel. So far, so good.

BUT now when I try to open that file with Firefox I just get a popup
asking me what I want to open it with -- Chrome, or 3 other NOT-FIREFOX
things. I suppose I could try emailing it and looking at it with
android gmail, or looking at gmail with firefox, but somehow I don't see
anything different happening. I can open it with Firefox FROM DROPBOX,
but that requires wifi access, which I generally have turned off.

Apparently Pixel2 has set the browser default to itself, and I'm
reluctant to set the default to Firefox without knowing what that will
mess up.

Has anyone actually accomplished something similar?

--
Cheers, Bev
"Usenet is like a herd of performing elephants with diarrhea:
massive, difficult to redirect, awe-inspiring, entertaining,
and a source of mind-boggling amounts of excrement when you
least expect it." --Gene Spafford (1992)

On Sat, 25 Nov 2023 20:22:11 -0800, The Real Bev wrote:

> On my linux computer I export my bookmarks to an html file and use that
> for my home page. Easy to just search for what I know is there. I
> wanted to do the same thing with FF120/Android.
>
> I finally found a way to copy the file from my computer to the
> DCIM/Camera file that holds my photos (from which I FTB them to my
> computer via wifi) using the native Pixel 'files' utility. I also
> exported it to dropbox and downloaded it to the Pixel. So far, so good.
>
> BUT now when I try to open that file with Firefox I just get a popup
> asking me what I want to open it with -- Chrome, or 3 other NOT-FIREFOX
> things. I suppose I could try emailing it and looking at it with
> android gmail, or looking at gmail with firefox, but somehow I don't see
> anything different happening. I can open it with Firefox FROM DROPBOX,
> but that requires wifi access, which I generally have turned off.
>
> Apparently Pixel2 has set the browser default to itself, and I'm
> reluctant to set the default to Firefox without knowing what that will
> mess up.
>
> Has anyone actually accomplished something similar?

See <https://support.mozilla.org/en-US/questions/1329243>

Current versions of Firefox for Android do not support opening local
files, whether they are .html files or otherwise.

You may *try* entering a file: URL in the URL bar, for example
"file:///sdcard/downloads/bookmarks.html"
but this will not work in current versions of Firefox for Android.

At one time Firefox for Android used to support opening local files,
but this was removed about 3 years ago in I think version 85.

--
Kind regards
Ralph Fox

​️HǷÆT ǷE GARDENA ın ᵹeaꞃ ꝺaᵹum þeoꝺ cẏnınᵹa þꞃẏm ᵹeꝼꞃunon hu ða æþelınᵹaꞅ ellen ꝼꞃemeꝺon.

The Real Bev wrote:

> Apparently Pixel2 has set the browser default to itself, and I'm
> reluctant to set the default to Firefox without knowing what that will
> mess up.

I've 'always' set firefox as my default browser on android, with no bad
effects.

On 26.11.23 09:41, Andy Burns wrote:
> The Real Bev wrote:
>
>> Apparently Pixel2 has set the browser default to itself, and I'm
>> reluctant to set the default to Firefox without knowing what that will
>> mess up.
>
> I've 'always' set firefox as my default browser on android, with no bad
> effects.

Same here since my Nexus 5X up to my current Pixel 7.
Never ever Chrome.

--
"Gutta cavat lapidem." (Ovid)

On 26 Nov 2023 19:23:20 +1300 Ralph Fox wrote:
>On Sat, 25 Nov 2023 20:22:11 -0800, The Real Bev wrote:
>
>> On my linux computer I export my bookmarks to an html file and use that
>> for my home page. Easy to just search for what I know is there. I
>> wanted to do the same thing with FF120/Android.
>>
>><snip>
>>
>> Has anyone actually accomplished something similar?

>See <https://support.mozilla.org/en-US/questions/1329243>
>
>Current versions of Firefox for Android do not support opening local
>files, whether they are .html files or otherwise.
>
>You may *try* entering a file: URL in the URL bar, for example
> "file:///sdcard/downloads/bookmarks.html"
>but this will not work in current versions of Firefox for Android.
>
>At one time Firefox for Android used to support opening local files,
>but this was removed about 3 years ago in I think version 85.

And you can't customize the Fx Android homepage to show a wepage.

You could put it on a server, either on the internet (I use github pages
for such things) or a server on your local network. Then have that as the
first bookmark. But that's 3 taps to display.

On nightly I have 'pinned sites' on my homepage, so those are available
with one tap. But I can't find that feature in Release 120 - or in the
latest nightly!

Lack of the file:// method is a pain. To test html layouts I have to use a
real server.

--
(Remove numerics from email address)

On 26 Nov 2023 09:57:50 -0000 (UTC) Dave Royal wrote:
>
>You could put it on a server, either on the internet (I use github pages
>for such things) or a server on your local network. Then have that as the
>first bookmark. But that's 3 taps to display.
>
>On nightly I have 'pinned sites' on my homepage, so those are available
>with one tap. But I can't find that feature in Release 120 - or in the
>latest nightly!

They're called 'shortcuts'. Customize the homepage to include (only?)
shortcuts. Open a webpage (eg your bookmark page on github pages) then
select 'Add to shortcuts'. I like to keep my top sites in a fixed position
but you can't reorder them which is a nuisance. You can pin and unpin them
on the homepage.
--
(Remove numerics from email address)

On 11/25/23 23:22, The Real Bev wrote:
> On my linux computer I export my bookmarks to an html file and use that
> for my home page.  Easy to just search for what I know is there.  I
> wanted to do the same thing with FF120/Android.
>
> I finally found a way to copy the file from my computer to the
> DCIM/Camera file that holds my photos (from which I FTB them to my
> computer via wifi) using the native Pixel 'files' utility.  I also
> exported it to dropbox and downloaded it to the Pixel. So far, so good.
>
> BUT now when I try to open that file with Firefox I just get a popup
> asking me what I want to open it with -- Chrome, or 3 other NOT-FIREFOX
> things.  I suppose I could try emailing it and looking at it with
> android gmail, or looking at gmail with firefox, but somehow I don't see
> anything different happening.  I can open it with Firefox FROM DROPBOX,
> but that requires wifi access, which I generally have turned off.
>
> Apparently Pixel2 has set the browser default to itself, and I'm
> reluctant to set the default to Firefox without knowing what that will
> mess up.
>
> Has anyone actually accomplished something similar?

cross-post snipped

Diagonally off-topic but I have to throw it in.

I have for years wished and screamed for an OPTIONAL bookmark HTML file
that the web-navigator can simply be pointed to and which, during use by
that app on that OS will edit it. When another OS and/or navigator is
loaded it would take over the file because it too would be pointed to it
as its bookmarks in prefs. This used to work until they killed it off
and brought in the database approach which could well be the other
OPTION. At one time I would have wanted to park this file on my site and
that's how I thought of it again today, reading this post.

Andy Burns <usenet@andyburns.uk> wrote

> The Real Bev wrote:
>
>> Apparently Pixel2 has set the browser default to itself, and I'm
>> reluctant to set the default to Firefox without knowing what that will
>> mess up.
>
> I've 'always' set firefox as my default browser on android, with no bad
> effects.

On Android, Chrome is one of the first system apps I instantly uninstall.
C:\> adb shell pm uninstall --user 0 com.android.chrome

As with others, on my unrootable Samsung, I have set a different browser as
my Android default with no ill effects that I am aware of. Mine happens to
be Ungoogled Chromium at the moment, but I change it from time to time.

On Windows, my default browser is set to a crippled-on-purpose executable,
but that's mainly because the default browser only seems to pop up when
something else brings it up, and not when I want to open something up.

I would let The Real Bev know that changing the default browser won't hurt
anything that I'm aware of on Android, which would mean that the HTML file
from Linux will open in the newly-set default browser on Android.

However... maybe The Real Bev can just use the Android Firefox "File ->
Open" command, pointing to the location of the HTML file?

One caveat is that Android browsers don't have the full functionality of
the desktop browsers (in my humble assessment).

Having suggested that in a sincere attempt to help The Real Bev, I will
caveat the warning that I don't browse all that much on Android.
--
Usenet is an attempt at a community of do gooders to help each other out.

Wally J wrote:

> I would let The Real Bev know that changing the default browser won't hurt
> anything that I'm aware of on Android, which would mean that the HTML file
> from Linux will open in the newly-set default browser on Android.

I've just tried with a .html file in the Downloads folder and
firefox/fenix doesn't offer itself as one of the options to open with.

On 11/26/23 7:45 AM, Andy Burns wrote:
> Wally J wrote:
>
>> I would let The Real Bev know that changing the default browser won't hurt
>> anything that I'm aware of on Android, which would mean that the HTML file
>> from Linux will open in the newly-set default browser on Android.
>
> I've just tried with a .html file in the Downloads folder and
> firefox/fenix doesn't offer itself as one of the options to open with.

Crap. The reason I worry is that FF/linux frequently doesn't even see
some 'security' features offered by some websites. They just sit there
waiting for something to happen. If I copy the URL into chrome a
reCaptcha (or something) shows up and I can continue. This is easy to
do on a computer, but NOTHING is easy on a phone :-(

--
Cheers, Bev
"Usenet is like a herd of performing elephants with diarrhea:
massive, difficult to redirect, awe-inspiring, entertaining,
and a source of mind-boggling amounts of excrement when you
least expect it." --Gene Spafford (1992)

On 2023-11-26 16:45, Andy Burns wrote:
> Wally J wrote:
>
>> I would let The Real Bev know that changing the default browser
>> won't hurt anything that I'm aware of on Android, which would mean
>> that the HTML file from Linux will open in the newly-set default
>> browser on Android.
>
> I've just tried with a .html file in the Downloads folder and
> firefox/fenix doesn't offer itself as one of the options to open
> with.

Confirm.

I also tried typing file:///downloads/test.html and firefox called
stupid google to find it, instead of just opening it.

IMO, the support for opening local files has been removed from FF in
Android.

--
Cheers,
Carlos E.R.

On 26 Nov 2023 19:23:20 +1300 Ralph Fox wrote:
>
>
>
>
>See <https://support.mozilla.org/en-US/questions/1329243>
>
>Current versions of Firefox for Android do not support opening local
>files, whether they are .html files or otherwise.
>
>You may *try* entering a file: URL in the URL bar, for example
> "file:///sdcard/downloads/bookmarks.html"
>but this will not work in current versions of Firefox for Android.
>
>At one time Firefox for Android used to support opening local files,
>but this was removed about 3 years ago in I think version 85.

I'm pretty sure the file: 'protocol' was never in Fenix, though it was in
Fennec - the last version of which was 68 iirc. javascript: was also
removed, so no more bookmarklets.

Probably some others. Was gopher ever in Fennec?

--
(Remove numerics from email address)

On 2023-11-26 17:31, The Real Bev wrote:
> On 11/26/23 7:45 AM, Andy Burns wrote:
>> Wally J wrote:
>>
>>> I would let The Real Bev know that changing the default browser won't
>>> hurt
>>> anything that I'm aware of on Android, which would mean that the HTML
>>> file
>>> from Linux will open in the newly-set default browser on Android.
>>
>> I've just tried with a .html file in the Downloads folder and
>> firefox/fenix doesn't offer itself as one of the options to open with.
>
> Crap. The reason I worry is that FF/linux frequently doesn't even see
> some 'security' features offered by some websites.  They just sit there
> waiting for something to happen.  If I copy the URL into chrome a
> reCaptcha (or something) shows up and I can continue.  This is easy to
> do on a computer, but NOTHING is easy on a phone :-(
>

Hamburguer menu, "share...", and then choose "Firefox". Or the reverse.

--
Cheers,
Carlos E.R.

On 11/26/23 10:47 AM, Carlos E. R. wrote:
> On 2023-11-26 17:31, The Real Bev wrote:
>> On 11/26/23 7:45 AM, Andy Burns wrote:
>>> Wally J wrote:
>>>
>>>> I would let The Real Bev know that changing the default browser won't
>>>> hurt
>>>> anything that I'm aware of on Android, which would mean that the HTML
>>>> file
>>>> from Linux will open in the newly-set default browser on Android.
>>>
>>> I've just tried with a .html file in the Downloads folder and
>>> firefox/fenix doesn't offer itself as one of the options to open with.
>>
>> Crap. The reason I worry is that FF/linux frequently doesn't even see
>> some 'security' features offered by some websites.  They just sit there
>> waiting for something to happen.  If I copy the URL into chrome a
>> reCaptcha (or something) shows up and I can continue.  This is easy to
>> do on a computer, but NOTHING is easy on a phone :-(
>>
>
> Hamburguer menu, "share...", and then choose "Firefox". Or the reverse.

Thanks. If it's that easy it's something to think about...

--
Cheers, Bev
"I used to be convinced that MicroSquish shipped crap because they
simply didn't give a flying fuck as long as the sheep kept buying
their shit. Now, I'm convinced that they really do ship the best
products they are capable of writing, and *that's* tragic."
- John C. Randolph, about MS quality control.

On 2023-11-26 20:14, The Real Bev wrote:
> On 11/26/23 10:47 AM, Carlos E. R. wrote:
>> On 2023-11-26 17:31, The Real Bev wrote:
>>> On 11/26/23 7:45 AM, Andy Burns wrote:
>>>> Wally J wrote:
>>>>
>>>>> I would let The Real Bev know that changing the default browser
>>>>> won't hurt
>>>>> anything that I'm aware of on Android, which would mean that the
>>>>> HTML file
>>>>> from Linux will open in the newly-set default browser on Android.
>>>>
>>>> I've just tried with a .html file in the Downloads folder and
>>>> firefox/fenix doesn't offer itself as one of the options to open with.
>>>
>>> Crap. The reason I worry is that FF/linux frequently doesn't even see
>>> some 'security' features offered by some websites.  They just sit
>>> there waiting for something to happen.  If I copy the URL into chrome
>>> a reCaptcha (or something) shows up and I can continue.  This is easy
>>> to do on a computer, but NOTHING is easy on a phone :-(
>>>
>>
>> Hamburguer menu, "share...", and then choose "Firefox". Or the reverse.
>
> Thanks.  If it's that easy it's something to think about...

Just open now a page in any of the two, then try to switch to the other
browser by "sharing" the link. Find out how it goes :-)

--
Cheers,
Carlos E.R.

Andy Burns <usenet@andyburns.uk> wrote

>> I would let The Real Bev know that changing the default browser won't hurt
>> anything that I'm aware of on Android, which would mean that the HTML file
>> from Linux will open in the newly-set default browser on Android.
>
> I've just tried with a .html file in the Downloads folder and
> firefox/fenix doesn't offer itself as one of the options to open with.

BTW, there is another option but it's a bitch (modifying intents).
<https://i.postimg.cc/FzD9Lcbf/afp07.jpg>

While modifying intents might work, I don't know much about doing it.
<https://i.postimg.cc/FFfGnmkS/afp15.jpg>

I was only messing with them because I was able to get both the Aurora
Store developer and the App Finder developer on XDA Developers to add the
ability for people like me (who have no Google Account on the phone so we
can't use the Google Play Store app) to use their apps more easily.

The point is the Firefox folks _could_ make it easy for TheRealBev if
Firefox developers wanted to... but it doesn't seem like they want to.

On Sun, 26 Nov 2023 18:13:46 -0000 (UTC), Dave Royal wrote:
> On 26 Nov 2023 19:23:20 +1300 Ralph Fox wrote:
>>
>> See <https://support.mozilla.org/en-US/questions/1329243>
>>
>> Current versions of Firefox for Android do not support opening local
>> files, whether they are .html files or otherwise.
>>
>> You may *try* entering a file: URL in the URL bar, for example
>> "file:///sdcard/downloads/bookmarks.html"
>> but this will not work in current versions of Firefox for Android.
>>
>> At one time Firefox for Android used to support opening local files,
>> but this was removed about 3 years ago in I think version 85.
>
> I'm pretty sure the file: 'protocol' was never in Fenix, though it was in
> Fennec - the last version of which was 68 iirc. javascript: was also
> removed, so no more bookmarklets.

AIUI Fenix was not offered as an option when you tapped on an HTML file,
but prior to version 86 you could still type a file: URL in the address
bar to open a file. See this discussion started in January 2020:
<https://github.com/mozilla-mobile/fenix/issues/7546>

The 'file:' protocol was removed in 2021 to fix the CVE-2021-23977
vulnerability that allowed a malicious application to read sensitive
data from Firefox for Android's application directories.

* Here is the CVE: <https://nvd.nist.gov/vuln/detail/CVE-2021-23977>

* The bugzilla bug for the CVE is #1684761, titled "Firefox for
Android - Theft of sensitive data".
<https://bugzilla.mozilla.org/show_bug.cgi?id=1684761>
According to that, it was fixed in Firefox 86 (I was wrong about 85).

* The corresponding bug in mozilla-mobile github is #9325, titled
"Bug 1684761".
<https://github.com/mozilla-mobile/android-components/issues/9325>
Set to 'Done' on Jan 7, 2021.

* Here is the corresponding code change in github, titled "Closes #9325:
engine-gecko: Introduce blocked schemes".
<https://github.com/mozilla-mobile/android-components/commit/67d138fe074177e51895fc191451ce64e170a29f>
This change blocked the file: protocol. Committed on Jan 7, 2021.

* Here is the list of security vulnerabilities fixed in Firefox 86,
including CVE-2021-23977.
<https://www.mozilla.org/en-US/security/advisories/mfsa2021-07/#CVE-2021-23977>

* I understand they would like to be able to re-enable the file:
protocol while also keeping the CVE bug fixed, but this is not
straightforward.
See bugzilla bug #1684947 titled "Disallow loading file:/// URIs
from within the data folder",
<https://bugzilla.mozilla.org/show_bug.cgi?id=1684947>,
and note this comment:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To re-enable the file:/// protocol we want to at least be able to
unconditionally forbid reading from the app's internal directories
(which is what this bug is about), IIRC this is not straightforward
because Gecko internally uses the file protocol so it needs access
to those private folders.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

> Probably some others. Was gopher ever in Fennec?

--
Kind regards
Ralph Fox

Nie mój cyrk, nie moje małpy

On 27 Nov 2023 14:20:07 +1300 Ralph Fox wrote:
>On Sun, 26 Nov 2023 18:13:46 -0000 (UTC), Dave Royal wrote:
>> On 26 Nov 2023 19:23:20 +1300 Ralph Fox wrote:
>>>
>>> See <https://support.mozilla.org/en-US/questions/1329243>
>>>
>>> Current versions of Firefox for Android do not support opening local
>>> files, whether they are .html files or otherwise.
>>> [snip]
>>> At one time Firefox for Android used to support opening local files,
>>> but this was removed about 3 years ago in I think version 85.
>>
>> I'm pretty sure the file: 'protocol' was never in Fenix, though it was in
>> Fennec - the last version of which was 68 iirc. javascript: was also
>> removed, so no more bookmarklets.
>
>AIUI Fenix was not offered as an option when you tapped on an HTML file,
>but prior to version 86 you could still type a file: URL in the address
>bar to open a file. See this discussion started in January 2020:
><https://github.com/mozilla-mobile/fenix/issues/7546>
>
>
>The 'file:' protocol was removed in 2021 to fix the CVE-2021-23977
>vulnerability that allowed a malicious application to read sensitive
>data from Firefox for Android's application directories.
>
> * Here is the CVE: <https://nvd.nist.gov/vuln/detail/CVE-2021-23977>
>
> * The bugzilla bug for the CVE is #1684761, titled "Firefox for
> Android - Theft of sensitive data".
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1684761>
> According to that, it was fixed in Firefox 86 (I was wrong about 85).
>
> * The corresponding bug in mozilla-mobile github is #9325, titled
> "Bug 1684761".
> <https://github.com/mozilla-mobile/android-components/issues/9325>
> Set to 'Done' on Jan 7, 2021.
>
> * Here is the corresponding code change in github, titled "Closes #9325:
> engine-gecko: Introduce blocked schemes".
>
><https://github.com/mozilla-mobile/android-components/commit/67d138fe074177e51895fc191451ce64e170a29f>
> This change blocked the file: protocol. Committed on Jan 7, 2021.
>
> * Here is the list of security vulnerabilities fixed in Firefox 86,
> including CVE-2021-23977.
>
><https://www.mozilla.org/en-US/security/advisories/mfsa2021-07/#CVE-2021-23977>
>
> * I understand they would like to be able to re-enable the file:
> protocol while also keeping the CVE bug fixed, but this is not
> straightforward.
> See bugzilla bug #1684947 titled "Disallow loading file:/// URIs
> from within the data folder",
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1684947>,
> and note this comment:
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> To re-enable the file:/// protocol we want to at least be able to
> unconditionally forbid reading from the app's internal directories
> (which is what this bug is about), IIRC this is not straightforward
> because Gecko internally uses the file protocol so it needs access
> to those private folders.
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
My mistake. Thanks for finding those later bugs. I remembered the security
argument but like most thing in fenix github issues they never explained
it - it was just an assertion. I hadn't noticed that there was an
initiative to re-enable it.

In fennec I had a bookmark to files:///data/data/org.mozilla.fenix/ (iirc)
which allowed me to view files in the profile, such as addon local
storage. Now I have to use remote debugging on a PC.

I'm currently testing a webpage that I want to look identical on a desktop
and 10" tablet, and occupy the whole display of a 4" iPhone. That would be
so much easier with file:///
--
(Remove numerics from email address)

On 27 Nov 2023 07:46:08 -0000 (UTC) Dave Royal wrote:

>My mistake.
But digging into this bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=1684761
I see this:

"I was wrong about Fenix not supporting file:// URLs when loaded via the
toolbar. Despite all issues being closed as "won't fix", loading a local
file works fine. I just successfully loaded an image from
file://storage/... in Fenix release (84.1.2)."

"Loading file:// URLs in Fenix works by accident and is not officially
supported."

I wonder whether 'not officially supported' means it works but is not
documented. (Is it 'officially supported' on desktop?) Does 'despite all
issues being closed' mean it was supposed to be removed from Fenix but
wasn't?

Oh well, it's water under the bridge.

--
(Remove numerics from email address)

On Mon, 27 Nov 2023 07:46:08 -0000 (UTC), Dave Royal wrote:

> In fennec I had a bookmark to files:///data/data/org.mozilla.fenix/ (iirc)
> which allowed me to view files in the profile, such as addon local
> storage. Now I have to use remote debugging on a PC.
>
> I'm currently testing a webpage that I want to look identical on a desktop
> and 10" tablet, and occupy the whole display of a 4" iPhone. That would be
> so much easier with file:///

This page mentions a possible work-around:

"Add support for file:// URI (open local HTML files) in Firefox Android"
<https://connect.mozilla.org/t5/ideas/add-support-for-file-uri-open-local-html-files-in-firefox/idi-p/11843>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A workaround for that (current version of Firefox Android) is to
install a HTTP server app on Android (example app
<https://play.google.com/store/apps/details?id=com.phlox.simpleserver>),
open Firefox Android, and enter the displayed URL on the app like
http://localhost:[port]/ , http://127.0.0.1:[port]/ or
http://[Local IP Address]:[port]/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--
Kind regards
Ralph

“Betere is appel yȝeue þen y-ete,” quoþ Hendyng.

Ralph Fox wrote:

> I understand they would like to be able to re-enable the file:
> protocol while also keeping the CVE bug fixed, but this is not
> straightforward.

Possibly they could make use of android's content provider URIs,
along the lines of

<content://storage/emulated/0/blah/foo.html>

On Mon, 27 Nov 2023 10:28:51 +0000, Andy Burns wrote:
> Ralph Fox wrote:

>> The bugzilla bug for the CVE is #1684761, titled "Firefox for
>> Android - Theft of sensitive data".
>> <https://bugzilla.mozilla.org/show_bug.cgi?id=1684761>
>> According to that, it was fixed in Firefox 86 (I was wrong about 85).
....
>> I understand they would like to be able to re-enable the file:
>> protocol while also keeping the CVE bug fixed, but this is not
>> straightforward.
>
> Possibly they could make use of android's content provider URIs,
> along the lines of
>
> <content://storage/emulated/0/blah/foo.html>

See comment 13 in the bugzilla bug for the CVE (link unsnipped above)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
We decided to work on a short-term fix in A-C to prevent loading
file:// and content:// URLs. A bigger discussion will be needed if
we ever want to support file:// URLs.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--
Kind regards
Ralph

“Fer from eȝe, fer from herte,” quoþ Hendyng.

On 28 Nov 2023 08:51:58 -0000 (UTC) Dave Royal wrote:
>On 26 Nov 2023 22:06:17 -0800 The Real Bev wrote:
>>On 11/26/23 8:33 PM, Wally J wrote:
>>> Andy Burns <usenet@andyburns.uk> wrote
>>>
>>>> Pretty sure it worked in firefox/fennec
>>>
>>> I was going to help out by testing that fennec [snip]
>>
>>Thanks for the thought. I downloaded it from f-droid but I haven't
>>played with it much yet.
>
>You can also download it from Mozilla's own archive. The latest version is
>68.11.0 I still have it on a phone which emulates Android 4.4.
>
>Not only does it accept the file:// method - so it will display your html
>bookmarklet file - you can set that as a homepage like on desktop. (I used
>to have a SED script which removed all the bloat - 'last visited etc' -
>from that file, resequence it, and fit it on a small screen. Probably
>still got it somewhere.)
>
>But Fennec lacks 3 years of security updates, so I wouldn't use it.

Cross-posting that back into a.c.s.firefox as in the OP. Fenix/Fennec
handling of file:// is discussed in more detail there.

Opening files from Android file managers is concerned with Android intents
and app manifests and has been discussed at length in c.m.android.

--
(Remove numerics from email address)

Dave Royal <dave@dave123royal.com> wrote

>>>>> Pretty sure it worked in firefox/fennec
>>>>
>>>> I was going to help out by testing that fennec [snip]
>>>
>>>Thanks for the thought. I downloaded it from f-droid but I haven't
>>>played with it much yet.
>>
>>You can also download it from Mozilla's own archive. The latest version is
>>68.11.0 I still have it on a phone which emulates Android 4.4.
>>
>>Not only does it accept the file:// method - so it will display your html
>>bookmarklet file - you can set that as a homepage like on desktop. (I used
>>to have a SED script which removed all the bloat - 'last visited etc' -
>>from that file, resequence it, and fit it on a small screen. Probably
>>still got it somewhere.)
>>
>>But Fennec lacks 3 years of security updates, so I wouldn't use it.
>
> Cross-posting that back into a.c.s.firefox as in the OP. Fenix/Fennec
> handling of file:// is discussed in more detail there.

Thanks to Dave Royal for adding the Mozilla developers because this is
almost certainly an Android Mozilla bug (as the "Open With..." bug only
shows up in Mozilla-based browsers & not in Chromium-based browsers).

From my tests (& from the OP's report) this appears to be a Mozilla
specific flaw because everything works in the chromium-based browsers.
<https://i.postimg.cc/SsVLP5w1/openwith01.jpg> MiX file mgr

Thinking that the reason Mozilla browsers don't show up in the
OpenAs/OpenWith menu might be a file-manager issue, I tested many.
<https://i.postimg.cc/C5dm8sV8/openwith02.jpg> Simple Mobile file mgr
<https://i.postimg.cc/SKqddhhk/openwith03.jpg> MK Explorer file mgr
<https://i.postimg.cc/NGPNcS1k/openwith04.jpg> FX file mgr
<https://i.postimg.cc/zGcrv1zK/openwith05.jpg> Samsung My Files file mgr

The Chromium-based browsers open an HTML file in all tested file managers.
The Mozilla-based browsers do not.

That's strange.

Since I'm like Paul, Herbert, Andy & Stan, et al., I'm a purposefully
helpful guy who tested this problem set for TheRealBev, yet I'm confused.

I first tested a whole bunch of browsers for TheRealBev, installing
OperaMini, Fennec (from F-Droid), Firefox Focus & Firefox browsers.
<https://i.postimg.cc/P5QkW1Zb/openwith06.jpg>

I "think" the problem is one of two (neither of which work for TheRealBev),
which, after copying Firefox's exported bookmarks.html from Linux to
Android, Firefox on Android had no "file -> open" capability to read it.

But when I tested _all_ the Android web browsers, none of them had it.]
Why not?

I have no clue.
Maybe you can tell me why Android browsers lack "File -> Open" menus.

In addition, I "think" the second problem was that even with the Android
Firefox set as the default for HTML files, tapping on the exported
bookmarks.html file in Android did NOT bring it up in the Firefox browser.
*Firefox bookmarks file*
<https://groups.google.com/g/comp.mobile.android/c/HQmZPZF9-mk>

The OP (and I) would get a plethora of chromium-based choices, but nary a
single web browser based on Mozilla code stood a chance of working right.

Why would only Chromium-based browsers show up in the "Open With..." menu
for HTML files but no Mozilla-based web browsers show up properly for HTML?

> Opening files from Android file managers is concerned with Android intents
> and app manifests and has been discussed at length in c.m.android.

While I'm pretty sure Dave Royal is completely correct that the
flaw in Mozilla's coding is in Android intents, I don't understand them.

This is a part of Android that thoroughly confuses me as I have been
successful getting the developers of two apps to make "Open With" menus
available - but they did all the work - not me. I merely had to clue them
in as to what the problem was (which I suspect is the Mozilla flaw here).

First, I had to show the App Finder developer (who is a great guy) that
people don't put Google Accounts on Android phones and so they can't use
the proprietary Google Play Store client and therefore they use the
non-proprietary open source Google Play Store clients which all use the
same "anonymous@google.com" Google Play Store repository login account.
*Skyica App Finder* replacement for Google Play Store repo search engine
<https://play.google.com/store/apps/details?id=scadica.aq>

Then I had to show the Aurora Store developers (who are also wonderful)
that they needed to add a few related things to enable OpenWith also.
*Aurora Store* anonymous replacement for Google Play Store client app
<https://aurorastore.org/>

Here you see I tested the App Finder which now does the "Open With..."
correctly when used on an Android phone sans any Google Account setup.
<https://xdaforums.com/t/app-6-0-app-finder-the-most-advanced-search-engine-for-android-apps.4578809/page-10#post-89024201>

And here you see I tested the Aurora Store beta which also now does the
"Open With..." properly for those who don't use the proprietary client.
<https://xdaforums.com/t/app-5-0-aurora-store-open-source-google-play-client.3739733/page-109#post-89023947>

Notice in both cases, as here with Mozilla, the developers never tested
their code in the way that the users use that code - but - the instant
the developers were aware of the bug - they immediately fixed it for me.

The point is that someone needs to explain to the Mozilla coders that they
too have to learn how to code Android apps so that "Open With..." works.

Right now, based on my tests (which reproduced what TheRealBev complained
about initially), none of the Mozilla-based web browsers work on Android.

As for the "intents", here is more detail but it's gory so it should only
be used to forward to Mozilla app developers so they learn how to code
Mozilla-based web browsers to work properly with HTML files on Android.

C:\> adb shell cmd activity start --user 0 -a android.intent.action.VIEW -d content://media/external/file/1000003696 -t text/html --ez from-myfiles true --eu android.intent.extra.STREAM content://media/external/file/1000003696 -f 50331649
URI=intent://media/external/file/1000003696#Intent;scheme=content;type=text/html;launchFlags=0x3000001;B.from-myfiles=true;end
ACTION=android.intent.action.VIEW
DATA=content://media/external/file/1000003696
TYPE=text/html
FLAGS=0x3000001
EXTRA=from-myfiles 0 true
EXTRA=android.intent.extra.STREAM 15 content://media/external/file/1000003696

MATCHING ACTIVITIES 21
0 LABEL HTML Viewer
NAME com.android.htmlviewer.HTMLViewerActivity
PACKAGE com.android.htmlviewer
1 LABEL Text Reader
NAME com.amaze.filemanager.ui.activities.texteditor.TextEditorActivity
PACKAGE com.amaze.filemanager
2 LABEL AEE Text Editor
NAME com.apk.editor.activities.TextEditorActivity
PACKAGE com.apkeditor.new.explorer3
3 LABEL Epic
NAME com.google.android.apps.chrome.IntentDispatcher
PACKAGE com.epic.browser
4 LABEL Text viewer
NAME com.lonelycatgames.Xplore.TextViewer
PACKAGE com.lonelycatgames.Xplore
5 LABEL Simple Text Editor
NAME com.maxistar.textpad.activities.EditorActivity
PACKAGE com.maxistar.textpad
6 LABEL Text Editor
NAME com.mixplorer.activities.TextEditorActivity
PACKAGE com.mixplorer
7 LABEL Code Editor
NAME com.mixplorer.activities.CodeEditorActivity
PACKAGE com.mixplorer
8 LABEL HTML Viewer
NAME com.mixplorer.activities.ContentViewerActivity
PACKAGE com.mixplorer
9 LABEL File Editor
NAME com.simplemobiletools.filemanager.pro.activities.ReadTextActivity
PACKAGE com.simplemobiletools.filemanager.pro
10 LABEL Termux
NAME com.termux.filepicker.TermuxFileReceiverActivity
PACKAGE com.termux
11 LABEL Interceptor
NAME io.github.muntashirakon.AppManager.intercept.ActivityInterceptor
PACKAGE io.github.muntashirakon.AppManager
12 LABEL Text editor
NAME me.zhanghai.android.files.viewer.text.TextEditorActivity
PACKAGE me.zhanghai.android.files
13 LABEL FX Text Viewer
NAME nextapp.fx.ui.viewer.TextViewerActivity
PACKAGE nextapp.fx
14 LABEL FX TextEdit
NAME nextapp.fx.ui.textedit.EditorActivity
PACKAGE nextapp.fx
15 LABEL OpenContacts
NAME opencontacts.open.com.opencontacts.activities.ImportVcardActivity
PACKAGE opencontacts.open.com.opencontacts
16 LABEL Bromite
NAME com.google.android.apps.chrome.IntentDispatcher
PACKAGE org.bromite.bromite
17 LABEL Chromium
NAME com.google.android.apps.chrome.IntentDispatcher
PACKAGE org.bromite.chromium
18 LABEL Ungoogled Chromium
NAME com.google.android.apps.chrome.IntentDispatcher
PACKAGE org.ungoogled.chromium.stable
19 LABEL Switch to work profile
NAME com.android.internal.app.ForwardIntentToManagedProfile
PACKAGE android
20 LABEL Save as
NAME org.openintents.filemanager.SaveAsActivity
PACKAGE org.openintents.filemanager

Ralph Fox <-rf-nz-@-.invalid> schrieb:

> See comment 13 in the bugzilla bug for the CVE (link unsnipped
> above)
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We decided to work on a
> short-term fix in A-C to prevent loading file:// and content://
> URLs. A bigger discussion will be needed if we ever want to
> support file:// URLs. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ QUOTE
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Strange. I'm wondering, how Chrome is able to open local files without
big security problems.
When I want to open them, Firefox should not disallow that. A warning
would be enough, if really necessary. IMHO the bigger "security problem"
is to load remote files...

cu,
Christian

PGP Key available.