6 ms·

Am I the only one who's not comfortable with the fact that the "whatsnew"[1] page can activate my browsers menu with Javascript? [1] https://www.mozilla.org/sv

Am I the only one who's not comfortable with the fact that the "whatsnew"[1] page can activate my browsers menu with Javascript? [1] https://www.mozilla.org/sv-SE/firefox/29.0/whatsnew/?oldversion=28.0 https://www.mozilla.org/sv-SE/firefox/29.0/whatsnew/?oldvers...

icebraining 13y ago
What menu? I don't see any of that.
- mindphaze 13y ago
  You need to be using version 29 when you click that link to see a tutorial that accesses the menu.
lucb1e 13y ago
I don't think any page can do that. Probably something built into the browser specifically for this page, identified by the domain or something.
- deleted 13y ago
  [deleted]
- gulbrandr 13y ago
  It seems so: http://dxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js#254 http://dxr.mozilla.org/mozilla-central/source/browser/app/pr...
  - abus 13y ago
    Strangely if you erase or change the value of that preference, it still runs. Does that mean it's checking something else?
    - mnoorenberghe 13y ago
      Hello, I'm one of the developers of the tour module on the Firefox team. The whitelist preference adds the whitelisted domains to the permission database when the application is upgrade to today's released (version 29) so changing the preference doesn't change the domains already whitelisted. You can disable the feature using the browser.uitour.enabled if for some reason this feature bothers you. Note that is also requires HTTPS for the whitelist domains too.
zimbatm 13y ago
Definitely raised an eyebrow. I don't know the implementation but it's looking for trouble.
- thousande 13y ago
  https://news.ycombinator.com/item?id=7667795 https://news.ycombinator.com/item?id=7667795
abus 13y ago
about:config browser.uitour.enabled to disable it.
gulbrandr 13y ago
The JavaScript code for it is in https://mozorg.cdn.mozilla.net/media/js/firefox_tour_whatsnew-min.js https://mozorg.cdn.mozilla.net/media/js/firefox_tour_whatsne... It uses the following command to open the menu: document.dispatchEvent(new CustomEvent("mozUITour", {bubbles: true, detail: {action: "showMenu", data: {name: "appMenu"} }})) I found the source code here : https://github.com/Unfocused/mozilla-uitour/blob/master/src/mozilla-uitour.js https://github.com/Unfocused/mozilla-uitour/blob/master/src/... This code http://dxr.mozilla.org/mozilla-central/source/browser/modules/UITour.jsm http://dxr.mozilla.org/mozilla-central/source/browser/module... seems to handle to JavaScript event dispatches.
alxgbsn 13y ago
I'm a web developer on mozilla.org, so can provide some information here. The "mozUITour" API is specific to Firefox 29, and can only be used on mozilla.org, which is a white-listed domain that is hard-coded into the browser. The API is also pretty basic, in that it can highlight a limited number of target icons, and open a limited choice of menu's. The purpose of the API is strictly for on-boarding flows, such as this. It also only works over https and requires a secure connection.
- abus 13y ago
  It can spy on what you type in the address bar... Hilarious when the new header is "Committed to your privacy".
  - hub_ 13y ago
    The word processor can spay what you are typing. Also this web page can spy the comment I am typing. Including the stuff I deleted. Please before it say "it spies", show us what it captured and sent to third-parties (ie not YOU).
    - angersock 13y ago
      "The word processor can spay what you are typing. " I for one am displeased when my missives are neutered by my text editors. :)
      - walid 13y ago
        The word processor can spay the Firevixen :)
  - mnoorenberghe 13y ago
    Actually the page can only be notified when you type a certain message in the address bar and it's limited to ONE message in a browser window so it can't try to watch for a list of strings. When there is a match a new tab will open up so you would notice this if it was being used. This feature was intended for an easter egg so the page could say, for example, "let me know when the user types 'I love Firefox' in the address bar" and then open a tab with an easter egg page. Also note that all tour functionality only applies when the tour tab is selected. Hopefully this clarifies that the page can't really spy on the address bar.
thousande 13y ago
Stuff like this has been available for add-on authors for a while, https://developer.mozilla.org/en-US/Add-ons/Code_snippets/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/Add-ons/Code_snippets/In... Remember, the browser chrome/front-end for Firefox and add-ons is implemented using Web technologies (XUL, JavaScript and CSS) with more or less privileges. Edit: Fun tip: Choose the Hamburger menu -> DevTools (wrench icon) -> Browser Toolbox and inspect the chrome document like you inspect a web document.

icebraining 13y ago

What menu? I don't see any of that.

mindphaze 13y ago
You need to be using version 29 when you click that link to see a tutorial that accesses the menu.

lucb1e 13y ago

I don't think any page can do that. Probably something built into the browser specifically for this page, identified by the domain or something.

deleted 13y ago
[deleted]
gulbrandr 13y ago
It seems so: http://dxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js#254 http://dxr.mozilla.org/mozilla-central/source/browser/app/pr...
- abus 13y ago
  Strangely if you erase or change the value of that preference, it still runs. Does that mean it's checking something else?
  - mnoorenberghe 13y ago
    Hello, I'm one of the developers of the tour module on the Firefox team. The whitelist preference adds the whitelisted domains to the permission database when the application is upgrade to today's released (version 29) so changing the preference doesn't change the domains already whitelisted. You can disable the feature using the browser.uitour.enabled if for some reason this feature bothers you. Note that is also requires HTTPS for the whitelist domains too.

zimbatm 13y ago

Definitely raised an eyebrow. I don't know the implementation but it's looking for trouble.

thousande 13y ago
https://news.ycombinator.com/item?id=7667795 https://news.ycombinator.com/item?id=7667795

abus 13y ago

about:config browser.uitour.enabled to disable it.

gulbrandr 13y ago

The JavaScript code for it is in https://mozorg.cdn.mozilla.net/media/js/firefox_tour_whatsnew-min.js https://mozorg.cdn.mozilla.net/media/js/firefox_tour_whatsne... It uses the following command to open the menu: document.dispatchEvent(new CustomEvent("mozUITour", {bubbles: true, detail: {action: "showMenu", data: {name: "appMenu"} }})) I found the source code here : https://github.com/Unfocused/mozilla-uitour/blob/master/src/mozilla-uitour.js https://github.com/Unfocused/mozilla-uitour/blob/master/src/... This code http://dxr.mozilla.org/mozilla-central/source/browser/modules/UITour.jsm http://dxr.mozilla.org/mozilla-central/source/browser/module... seems to handle to JavaScript event dispatches.

alxgbsn 13y ago

I'm a web developer on mozilla.org, so can provide some information here. The "mozUITour" API is specific to Firefox 29, and can only be used on mozilla.org, which is a white-listed domain that is hard-coded into the browser. The API is also pretty basic, in that it can highlight a limited number of target icons, and open a limited choice of menu's. The purpose of the API is strictly for on-boarding flows, such as this. It also only works over https and requires a secure connection.

abus 13y ago
It can spy on what you type in the address bar... Hilarious when the new header is "Committed to your privacy".
- hub_ 13y ago
  The word processor can spay what you are typing. Also this web page can spy the comment I am typing. Including the stuff I deleted. Please before it say "it spies", show us what it captured and sent to third-parties (ie not YOU).
  - angersock 13y ago
    "The word processor can spay what you are typing. " I for one am displeased when my missives are neutered by my text editors. :)
    - walid 13y ago
      The word processor can spay the Firevixen :)
- mnoorenberghe 13y ago
  Actually the page can only be notified when you type a certain message in the address bar and it's limited to ONE message in a browser window so it can't try to watch for a list of strings. When there is a match a new tab will open up so you would notice this if it was being used. This feature was intended for an easter egg so the page could say, for example, "let me know when the user types 'I love Firefox' in the address bar" and then open a tab with an easter egg page. Also note that all tour functionality only applies when the tour tab is selected. Hopefully this clarifies that the page can't really spy on the address bar.

thousande 13y ago

Stuff like this has been available for add-on authors for a while, https://developer.mozilla.org/en-US/Add-ons/Code_snippets/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/Add-ons/Code_snippets/In... Remember, the browser chrome/front-end for Firefox and add-ons is implemented using Web technologies (XUL, JavaScript and CSS) with more or less privileges. Edit: Fun tip: Choose the Hamburger menu -> DevTools (wrench icon) -> Browser Toolbox and inspect the chrome document like you inspect a web document.