5 ms·
I think you’re right if you’re trying to enumerate where a plug-in will call. However it’s also possible to require that a plug-in provide a list of domains it
by ashtonkem 6y ago
I think you’re right if you’re trying to enumerate where a plug-in will call. However it’s also possible to require that a plug-in provide a list of domains it will call as part of its manifest, display that list to the user and use it as a white list for network access by the plug-in.
This ends up effect as magically determining where it’ll call, with a lot less work.
- wlesieutre 6y agoExcept the add on can inject js into webpages that you have open and let the page make connections outside the extension sandbox.
- lukevp 6y agoAlso it’s pretty easy to just proxy requests through a whitelisted server side site so https://good.com https://good.com is all that shows but it requests good.com?dest=https://evil.com https://evil.com
- srtjstjsj 6y agoCalling a website good.com doesn't make it good. A site with open redirects is a bad site.
- deleted 6y ago[deleted]
- ashtonkem 6y agoAh, that’s clearly a big issue. Never mind.
- Triv888 6y agoIs that why Mozilla is blocking all addons on mobile (except for the selected 11)? They need to fix that shit or start adding useful features to Firefox... Not sure why they arent blocking all extensions on desktop too if they are so bad though.
- soco 6y agoThey're already bleeding market share badly to the Chromium family, and doing that would be quite a thick nail to their popularity coffin...