4 ms·

security.sandbox.content.read_path_whitelist Are extensions allowed to change that?

Sylos 9y ago
I don't know for sure, but I heavily doubt it, as it would open up so many potential security holes. The standard way to access files for extensions seems to be with Native Messaging: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na... Basically make the user install a small program on their PC, then your extension talks to that program, the program reads out the file that you need and then hands it back to your extension.
Manishearth 9y ago
Not WebExtensions (which are the only kind of extension allowed on Firefox 57+ unless you change another pref). I mean, Firefox even has a `security.turn_off_all_security_so_that_viruses_can_take_over_this_computer` pref (used in testing; you won't see it in about:config but IIRC you can manually add it. Don't.). Prefs that break security are not new :)
- ComodoHacker 9y ago
  Oh, really? I hope not in production builds, at least. Defense in depth concept is not new either.
  - Manishearth 9y ago
    You also need an environment variable to be set for it to work. But yes, it seems to be something you can flip in production. The argument being that if you're in a position to flip prefs you already can break security in a million ways. It's not something you can accidentally flip either. (The pref doesn't actually "let viruses take over the computer", it just turns off all the security checks)
    - madez 9y ago
      I feel like having a global switch for all security checks is already not a good idea.
      - bugmen0t 9y ago
        It's unlikely to be abused by am attacker, if it requires starting Firefox with a certain environment variable. Chrome has the same thing with a command line switch. Useful for some internal unit/integration tests for release and test builds, but really dangerous when pointed to the web.
      - Manishearth 9y ago
        Actually, "all the security checks" is inaccurate; it seems to enable certain special powers in JS. It turns off one security measure. These special powers seem to be enough to compromise other stuff; but again, if you're in a position to flip that switch you already can compromise other stuff.
    - bzbarsky 9y ago
      It doesn't even turn off "all the security checks". It does make it so that certain APIs that let you do all sorts of stuff web content can't normally do are exposed.

I don't know for sure, but I heavily doubt it, as it would open up so many potential security holes. The standard way to access files for extensions seems to be with Native Messaging: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na... Basically make the user install a small program on their PC, then your extension talks to that program, the program reads out the file that you need and then hands it back to your extension.

Manishearth 9y ago

Not WebExtensions (which are the only kind of extension allowed on Firefox 57+ unless you change another pref). I mean, Firefox even has a `security.turn_off_all_security_so_that_viruses_can_take_over_this_computer` pref (used in testing; you won't see it in about:config but IIRC you can manually add it. Don't.). Prefs that break security are not new :)

ComodoHacker 9y ago
Oh, really? I hope not in production builds, at least. Defense in depth concept is not new either.
- Manishearth 9y ago
  You also need an environment variable to be set for it to work. But yes, it seems to be something you can flip in production. The argument being that if you're in a position to flip prefs you already can break security in a million ways. It's not something you can accidentally flip either. (The pref doesn't actually "let viruses take over the computer", it just turns off all the security checks)
  - madez 9y ago
    I feel like having a global switch for all security checks is already not a good idea.
    - bugmen0t 9y ago
      It's unlikely to be abused by am attacker, if it requires starting Firefox with a certain environment variable. Chrome has the same thing with a command line switch. Useful for some internal unit/integration tests for release and test builds, but really dangerous when pointed to the web.
    - Manishearth 9y ago
      Actually, "all the security checks" is inaccurate; it seems to enable certain special powers in JS. It turns off one security measure. These special powers seem to be enough to compromise other stuff; but again, if you're in a position to flip that switch you already can compromise other stuff.
  - bzbarsky 9y ago
    It doesn't even turn off "all the security checks". It does make it so that certain APIs that let you do all sorts of stuff web content can't normally do are exposed.