Security error loading local files using Ajax requests from FileAPI due to XHR over fetch not working for ms-appdata:

Hi Luis,

I am looking into the details about your question.  In the meantime, you might find this article interesting on the topic.

https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/#yIAYX7QAxE2CFzvo.97

Steve

Hi Luis,

Would you be willing to share your app or a simplified repro version?

Thank you,

The MS Edge Team

Hi,

I attached a demo for this issue (see zip file in attachment).

Repro steps:

1. Run the solution
2. Click in “Download image file” button
3. Click in “Load image using file API”
   [Result] The image is correctly rendered in right panel, regardless of Windows 10 release
4. Click in “Clear screen” button
5. Click in “Load image using Ajax request”
   [Result] Using Windows 10 release prior to Creators Update (1703), it works fine. The local image is correctly rendered.
   Using Windows 10 with release >= 1703, it throws an error when loading the image

My app, in some scenarios, needs to perform Ajax requests to local files hence it’s failing in devices with Windows 10 creators update installed.

Hi Luis,

Thank you for creating and sending the repro.  I was able to reproduce it.

One question, I thought I would double check on.  Are you using the Cordova Whitelist plugin?

https://taco.visualstudio.com/en-us/docs/cordova-security-whitlists/

I saw this note bolded in that link:

 "
A critical aspect of this security model is that 

absolutely no network access of any kind is allowed without the installation of a Cordova plugin
."

I see that you have it included.

As an fyi, this is the specific error I see for the image request being blocked:

“CSP14312: Resource violated directive 'default-src ‘self’ data: gap: https://www.w3.org ‘unsafe-eval’’ in <meta http-equiv="Content-Security-Policy">: ms-appdata:///local/w3c-developers.png. Resource will be blocked.”

Steve