evilpie

The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default.

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with.

- We are not, and have no plans to abandon MV2 extensions. This will ensure certain types of add-ons, like ad-blockers, continue to work best in Firefox.

- Firefox supports several ad-blockers as add-ons on Desktop and Android, including uBlock Origin.

- We are not bundling Brave's ad-blocking system, we're testing one of their open source Rust components to improve how Firefox processes tracker lists.

https://www.reddit.com/r/firefox/comments/1sttf82/firefox_wi...

This is what the official Firefox account had to say when this came up on reddit.

Yes. It's in about:keyboard.

You aren't reading it right.

  new Sanitizer({})

You might want something like:

  new Sanitizer({ replaceWithChildrenElements: ["h1"], elements: [], attributes: [] })

Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.

We enabled this by default in Firefox Nightly (only) this week.

Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.

https://extensionworkshop.com/documentation/publish/add-on-p...

While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.

For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...

If it's disabled (greyed-out), then you already have telemetry disabled.

Firefox also has the about:config preference permissions.default.image: 2, which will block most images.

The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.

See also https://ooooooooo.ooo/. "9o3o is an official (but experimental) online version of the Flashpoint Archive."

https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM...

Also one of the headings was mistranslated horribly.

In linked the article: "AVM threatens to ban the sale of Fritzbox routers". The original in German: "AVM droht Verkaufsverbot für Fritzbox-Router". Right translation is roughly: "AVM is threatened with a ban on the sale of Fritzbox routers".

See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...

Igalia is regularly contracted to work on new Firefox features, so this is already happening.

[deleted because I don't to be accused for ragebaiting]

As far as I can tell from my own recommended extensions is that every update needs to be approved/reviewed before it's made generally available.

And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken".

It's likely you forgot to include the browser_specific_settings with a some arbitrary id in the manifest.json.

Permanently installing unsigned extensions definitely works in the Developer Edition after setting the pref in about:config.

This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features.

Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.

Did you ever get around to communicating your use-case to the developers?

Type starting with x- are non-standard. x-moz- means it’s a mozilla-defined one. There seems to be no standard mime type for a URL

The standard web MIME for url(s) is text/uri-list: https://www.rfc-editor.org/rfc/rfc2483#section-5

Firefox will also rewrite YouTube embeds: https://searchfox.org/mozilla-central/rev/c6d17806faef8708b6....

Firefox also ships a "system" add-on (https://github.com/mozilla-extensions/webcompat-addon) that has interventions and user-agent overrides for many websites. See for yourself in Firefox on about:compat.

Seems like they don't mention that fact anywhere in the readme or homepage.

The actual bug was in the C++ code handling the Content-Length header (https://hg.mozilla.org/integration/autoland/rev/48c0e854be62...) and the Rust code just happened to be first to trigger it.

I was wondering if the recent falling out with France had something to do with it. Maybe this is a cheap way to earn some points with Macron after NSO was caught potentially? spying on him/his government.

Congrats to the team on shipping site isolation. This required a lot of work on very fundamental parts like frame/page loading.

All the bugs you linked are marked as fixed, so unless you open a new bug with clear steps of reproducing your specific issue, it's probably never going to happen.