Subject: Re: bug#65973: [PATCH] ; send filename, not full path, on EWW form submit

From: Stefan Kangas <[email-masked]>
Date: Wed, 6 Nov 2024 23:30:54 +0000

Jim Porter <[email-masked]> writes:

> On 11/5/2024 9:08 AM, Eli Zaretskii wrote:
>
>> I'd like some rationale for this change.  The original report never
>> explains why sending the full absolute file name to the server is bad.
>
> I see three possible reasons: 1) there could be (probably minor) privacy
> issues with sending the directory structure along to a server;

>From a privacy perspective, I don't think this we can really consider
this as a minor issue.

Users commonly use their full names, or another similarly unique
identifier, as their login name.  It goes without saying, that sending a
string such as "/home/myfullname/some/file" to a remote host completely
defeats all notions of preserving user privacy.