[FEATURE REQUEST] Show favicon icons for .url shortcuts

[felix-schwarz]

Presenting favicons for URLs in .url shortcut files has been suggested by @dj4oC and I'd like to put a few thoughts on this in an issue to possibly come back to it later or discuss it more broadly.

• if favicons should be presented in the file list, a good place to implement it could be on the server side. The server could then cache and serve the favicons as thumbnails to all clients.
• topics when implementing favicons locally:
  • to know the URL to retrieve the favicon for, the .url file needs to be downloaded first
  • to display the correct favicon for a page, the app would need to download the page and inspect it for elements like
    • <link rel="shortcut icon" href="custom-favicon.ico">
    • <link rel="apple-touch-icon" href="/apple-touch-icon.png">
    • <meta property="og:image" content="custom-image.jpg">
• automatically retrieving the page targeted by the URL could bear privacy and security risks
  • from a device: revealing the IP (and therefore possibly location) of the device user
  • from the server: a maliciously crafted page could be used to target possible vulnerabilities in the code parsing the page for the favicon as well as reveal the existence and IP of the server
  • if the URL is crafted to trigger an action that action could be triggered unintentionally
• implementing support for favicons intersects broadly with what would also be needed to add support for page previews based on Open Graph Tags, which could be an interesting addition for presenting and previewing URLs

[tbsbdr]

Prio: I'd say maybe some day - p4.
please do not invest any more time in this FR as it might bear quite some security and privacy risks (as described by you) we would need to mitigate. risk-value ratio is too low imo.

[felix-schwarz]

Looking at just allowing a shortcut to have a custom icon / thumbnail, here's an idea that crossed my mind and that I'd like to persist here:

.url shortcut files are just files in the ini-format with a InternetShortcut section and a URL key/value pair in it:

[InternetShortcut]
URL=https://owncloud.com/

Just like Microsoft added more key/value pairs for special purposes, ocis could do that, too, adding a key/value pair for both the (base64-encoded) icon image's data and then the format that icon image is encoded in. F.ex.:

[InternetShortcut]
URL=https://owncloud.com/
OcisIconType=image/png
OcisIconData=VGhpcyBpcyBub3QgYW4gYWN0dWFsIGltYWdlJ3MgZGF0YQ…

This would allow the server to return a thumbnail image for the shortcut file that is "generated" from the file's content itself.