evilpie
Joined 16 years ago
Karma
2,006
Submissions
156
Member since
Jan 16
Recent submissions
Comment · 6 months ago
The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default.
https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...
https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...
Comment · 6 months ago
> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with.
> - We are not, and have no plans to abandon MV2 extensions. This will ensure certain types of add-ons, like ad-blockers, continue to work best in Firefox.
> - Firefox supports several ad-blockers as add-ons on Desktop and Android, including uBlock Origin.
> - We are not bundling Brave's ad-blocking system, we're testing one of their open source Rust components to improve how Firefox processes tracker lists.
https://www.reddit.com/r/firefox/comments/1sttf82/firefox_wi...
This is what the official Firefox account had to say when this came up on reddit.
Comment · 8 months ago
Yes. It's in about:keyboard.
Comment · 8 months ago
You aren't reading it right.
new Sanitizer({})
You might want something like:
new Sanitizer({ replaceWithChildrenElements: ["h1"], elements: [], attributes: [] })
Comment · 8 months ago
Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.
Comment · 8 months ago
We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)
Comment · 1 year ago
If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.
Comment · 1 year ago
We enabled this by default in Firefox Nightly (only) this week.
Comment · 1 year ago
Make sure you have Firefox 138!
From the release notes:
> You can also now reposition a tab group on the tab bar by dragging it.
Comment · 1 year ago
Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.
https://extensionworkshop.com/documentation/publish/add-on-p...
Comment · 1 year ago
While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.
For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...
Comment · 2 years ago
If it's disabled (greyed-out), then you already have telemetry disabled.
https://hachyderm.io/@evilpie