4 ms·

Firefox really needs to fix their CSP for extensions before this kind of thing. Here is the 9 year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=126702

• Semaphor 2y ago
  Having fewer permissions for extensions than one might want seems fairly less important to making the browser more secure…
  • joshuaissac 2y ago
    Arguably, it can make it less secure by reducing the user's control over what content the browser loads or what scripts it executes. For example, users may be using extensions to selectively replace harmful content (like intrusive JavaScript, tracking) with benign content. It is a balance between security for the user and security for the website owner.
    • gear54rus 2y ago
      Exactly. It's been clearly established that web extensions' code is more priveleged than a page code, as it should be. The amount of people going 'muh sesoority' in this thread is baffling.
    • pessimizer 2y ago
      > It is a balance between security for the user and security for the website owner. Which in the case of browsers should always be decided for the user, rather than balanced. The browser is a user agent. It is running on the user's hardware.
  • raxxorraxor 2y ago
    In the current browser landscape I would think not. Firefox is no less secure than Chrome or Safari and both are subject to economic incentives. You could even argue these issues negatively relate to security as well.
• pama 2y ago
  Wouldn’t fixing this bug reduce security?
  • shakna 2y ago
    If you are using filter scripts, to block specific domains or script payloads, that extension can't load on a properly secured CSP page. And that page may be using CSP to protect throwing up ads... Or malware.
    • pama 2y ago
      Thanks.
  • davidmurdoch 2y ago
    No, it's explained more in the issue. An extension is a part of the "User Agent". The CSP header in FF is almost seemingly arbitrarily applied to extensions.
    • pama 2y ago
      Thanks!
• gear54rus 2y ago
  One of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage in the store, don't they?
  • evilpie 2y ago
    Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy. https://extensionworkshop.com/documentation/publish/add-on-policies/#development-practices https://extensionworkshop.com/documentation/publish/add-on-p...
    • gear54rus 2y ago
      I don't think this is being enforced in practice, thankfully.
      • davidmurdoch 2y ago
        It is. It happened to us a few weeks ago.
        • gear54rus 2y ago
          That's crazy. Did it happen to a public extension or an unlisted one?
          • davidmurdoch 2y ago
            Public, with about half a million installations. I think it was noticed only because this version had a major bug that broke a bunch of websites.
  • davidmurdoch 2y ago
    We modified the CSP to inject a per user generated nonce that exempts it script from the policy. They said this was not allowed and removed it from the extension store.
• evilpie 2y ago
  While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security. For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#issuecomment-1344313926 https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...
  • KwanEsq 2y ago
    And it's worth noting that since your comment later in that thread about sandbox being an issue, that's been fixed too as of Firefox 128: https://bugzilla.mozilla.org/show_bug.cgi?id=1411641 https://bugzilla.mozilla.org/show_bug.cgi?id=1411641
  • davidmurdoch 2y ago
    Thanks for this! I'll look into implementing it soon.