TEdgeBrowser : "Unsafe attempt to load URL"

[zsleo 0]

I have an app that uses TEdgeBrowser to display an XML file that points to a "very rich" XSL and DTD files that all reside in the same folder and sub-folder.

 

When attempting to load the file

file:///C:/program%20files/test/x_01.xml

 

The errors are

• Quote

  Unsafe attempt to load URL file:///C:/program%20files/Test/MPhIS.xsl from frame with URL file:///C:/program%20files/Test/x_01.xml. 'file:' URLs are treated as unique security origins.

  Unsafe attempt to load URL file:///C:/program%20files/Test/MPhIS.dtd from frame with URL file:///C:/program%20files/Test/x_01.xml. Domains, protocols and ports must match.

   

Does anyone have a workaround?

 

Some research suggests that starting the Edge Browser with the parameter --allow-file-access-from-files should solve the problem. How to I force TEdgeBrowser to start with parameters?

 

TIA 

 

P.S. Just edited to correctly reflect folder structure and to protect the innocent 🙂 

Edited October 13, 2022 by zsleo

[Lars Fosdal 1792]

Putting writable files under C:\Program Files is a very bad idea, but probably not related to the errors.

You could in theory have your own built in web server and serve the files from there to avoid direct file system access from the browser?

 

Comment #3 here is a possible explanation.

https://bugs.chromium.org/p/chromium/issues/detail?id=512542#c3

[salvadordf 34]

It's not easy to use Chromium command line switches with TEdgeBrowser.

 

Consider using WebView4Delphi instead and set GlobalWebView2Loader.AllowFileAccessFromFiles to true.

 

You can also use the VirtualHostBrowser demo as a template for your application. It maps a local directory to a custom domain to load files from the hard drive.

 

Edited October 13, 2022 by salvadordf

[Der schöne Günther 316]

Yes, this is a well known restriction of Chromium. It is so common that it baffles me this is also one of the many things that Embarcaderos wrapper TEdgeBrowser has no easy access to. You will either have to set environment variable you mentioned inside your own process (which should only be a last-resort workaround), start your own process with this command line argument (even worse) or make changes to the edge browser source code, so it will feed the required parameters into AdditionalBrowserArguments.

 

Or use another library that offers more flexibility.

 

2 hours ago, Lars Fosdal said:

Putting writable files under C:\Program Files is a very bad idea

That's for sure, but who said those files were writeable?

[Lars Fosdal 1792]

2 hours ago, Der schöne Günther said:

who said those files were writeable

It was an possibly premature assumption from my side...

[ertank 27]

On 10/13/2022 at 3:09 AM, zsleo said:

I have an app that uses TEdgeBrowser to display an XML file that points to a "very rich" XSL and DTD files that all reside in the same folder and sub-folder.

Is it possible for you to convert these files into a single HTML and load it as a file?

[zsleo 0]

On 10/13/2022 at 5:13 PM, Lars Fosdal said:

Putting writable files under C:\Program Files is a very bad idea, but probably not related to the errors.

You could in theory have your own built in web server and serve the files from there to avoid direct file system access from the browser?

 

Comment #3 here is a possible explanation.

https://bugs.chromium.org/p/chromium/issues/detail?id=512542#c3

Thank you.

 

Also, the app that controls that data is unfortunately installed in that location.

[zsleo 0]

On 10/13/2022 at 7:23 PM, salvadordf said:

It's not easy to use Chromium command line switches with TEdgeBrowser.

 

Consider using WebView4Delphi instead and set GlobalWebView2Loader.AllowFileAccessFromFiles to true.

 

You can also use the VirtualHostBrowser demo as a template for your application. It maps a local directory to a custom domain to load files from the hard drive.

 

I will give this a try.

[zsleo 0]

On 10/14/2022 at 3:33 PM, ertank said:

Is it possible for you to convert these files into a single HTML and load it as a file?

I did consider this but my app is deployed in some very locked down healthcare institutions through to very non-tech savvy sites. Deployment and ongoing support costs are an issue.

[zsleo 0]

On 10/14/2022 at 3:33 PM, ertank said:

Is it possible for you to convert these files into a single HTML and load it as a file?

This is very high end and complex clinical information and I can't take the risk of incorrect/mal conversion to html.

[zsleo 0]

On 10/13/2022 at 8:12 PM, Der schöne Günther said:

Yes, this is a well known restriction of Chromium. It is so common that it baffles me this is also one of the many things that Embarcaderos wrapper TEdgeBrowser has no easy access to. You will either have to set environment variable you mentioned inside your own process (which should only be a last-resort workaround), start your own process with this command line argument (even worse) or make changes to the edge browser source code, so it will feed the required parameters into AdditionalBrowserArguments.

 

Or use another library that offers more flexibility.

 

That's for sure, but who said those files were writeable?

Well detected :).  I have simplified the path string. During installation the "test" subfolder is permissioned for read/write and the "x_01.xml" is created on the fly for each user with with the substituted reference text, images and tables for specific to the user's pharmaceutical product selection.

[Lars Fosdal 1792]

8 hours ago, zsleo said:

Also, the app that controls that data is unfortunately installed in that location.

I'd complain loudly to the company that wrote that app.  These folders have been forbidden for the last 15 years - at least.

Dynamic data should go to user folders for user specific data, or AppData for system wide data.