Download attribute allows downloading local files
该报告还没有中文解读。
原文摘录
摘自原文（1245 字符中的一小部分）
The attribute `download` in a `a` tag allows for download the `href` target to file and saving it locally. In mozilla and chrome, it is forbidden to download local file via `file:// ..`, in Brave however this is not enforced and it is not clear to the user if they are downloading something remote …
原文中的代码
Name Version Brave 0.18.16 rev 8003c66 Muon 4.3.6 libchromiumcontent 60.0.3112.78 V8 6.0.286.44 Node.js 7.9.0 Update Channel dev OS Platform Linux OS Release 4.4.0-64-generic OS Architecture x64
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Brave Software 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @skansing · 版权归作者与 Brave Software 所有