[hackerone] consider disabling FTP

[diracdeltas]

Test plan

1. Visit https://dlptest.com/ftp-test/
2. Click on ftp://ftp.dlptest.com/
3. It should not work (no prompt for creds, etc). instead it should prompt to open an external app

Original issue description

https://hackerone.com/reports/378805

related:
https://hackerone.com/bugs?subject=brave&report_id=378809
https://hackerone.com/reports/378864

[tildelowengrimm]

FWIW, I think that Chrome has gone back and forth on this one a bunch of times. FTP within a regular browsing context is a bit of a bugbear. On the other hand, lots of documents are only available via FTP — especially legacy government documents. Leaving FTP support in the browser really lowers the barrier to accessing those materials.

Of course, we don't need to be the only way for journalists and so on to access government documents. I'd be pretty comfortable with ripping out FTP for the medium term and building it back as an independent feature with a modern security & privacy mindset later (perhaps much later).

[diracdeltas]

i think all of these issues are specific to muon + FTP, so when FTP returns in brave-core, it will probably not cause problems like these

[bsclifton]

Pushing back to release 5; we'll want to wait until after C68 is merged before merging the Muon changes required for this (see above links to PRs)

[bsclifton]

Fixed with brave/muon@25cf424

[LaurenWags]

@bsclifton to confirm, when I do those steps on macOS I get this notification banner:

And if I click Allow, I am prompted to enter credentials. I entered the creds from https://dlptest.com/ftp-test/ but couldn't login.

[diracdeltas]

i think the fact that it's prompting to open an external application is correct, since we will no longer handle FTP ourselves. not sure why the credentials don't work but that doesn't seem like a Brave bug.

[LaurenWags]

@diracdeltas so since I'm being prompted via the notification banner then this one is ok as is (at least on macOS)?

cc @kjozwiak so he can check on his machine as well.

[diracdeltas]

@LaurenWags yes this seems fine

[LaurenWags]

Verified with macOS 10.12.6 using

• 0.23.77 0125b5f
• Muon 8.0.6
• libchromiumcontent 68.0.3440.84

Verified with Ubuntu 17.10 x64 using the following build:

• 0.23.77 0125b5f
• muon: 8.0.6
• libchromiumcontent:68.0.3440.84

[srirambv]

@diracdeltas this is what happens on Windows with FTP linked to open in Brave. It goes on an infinite loop opening blank pages but never prompting to enter credentials.