Can an app or extension open files on system with permission “<all_urls>”?

问题

I thought Chrome apps were sandboxed, but I see that you can allow permissions for file:// urls, and there's a special matching pattern:

<all_urls>     Matches any URL that uses a permitted scheme. (See the beginning of this section for the list of permitted schemes.)

Are the file urls restricted to within the sandbox or can it really go anywhere?

回答1:

Yes, you can access the entire filesystem (subject to the permissions of the user account running Chrome). However, the user must explicitly activate access to file: URLs by checking the "Allow access to file URLs" box by your extension's listing in chrome://extensions. Your extension must satisfy both requirements:

1. include the permission in the manifest (either a particular file://... match pattern or <all_urls>), and

2. have the "Allow access to file URLs" box checked by the user.

See also How to allow a Google Chrome plugin to access files as webpages.

来源：https://stackoverflow.com/questions/17155916/can-an-app-or-extension-open-files-on-system-with-permission-all-urls