Can we please include the fixed Bug 863246

[dark_moon]

With Firefox 57 bug #863246 is fixed.
Would be nice if Pale Moon include that too.

See:
# https://www.bleepingcomputer.com/news/s ... n-systems/
# https://www.ghacks.net/2017/08/30/firef ... -internet/

[satrow]

I've not waded through the Bugzilla details but both of the other links refer to WebExtensions as being the problem (and was first detected in Chrome?), assuming that's correct it's n/a to Pale Moon.

[adesh]

Yes, this is N/A for Pale Moon, stated by Moonchild in Issue #1327

[Moonchild]

As far as resource:// "leaks" is concerned, no matter what kind of barrier is installed like in that BMO bug, any extension that needs resources from itself accessible to content-injected elements can still be detected by web pages, because it's not possible to make a distinction between native page scripts and injected extension scripts.
Even so, none of this will disclose any private information, since only static information will ever be available from resource:// URIs.

Also, the barrier installed in that bug precludes the use of "legacy" extensions that need this access, which is exactly why it won't be introduced in Firefox until 57.

[joe04]

As far as resource:// "leaks" is concerned, no matter what kind of barrier is installed like in that BMO bug, any extension that needs resources from itself accessible to content-injected elements can still be detected by web pages, because it's not possible to make a distinction between native page scripts and injected extension scripts.
Even so, none of this will disclose any private information, since only static information will ever be available from resource:// URIs.

Thanks for clarifying that. Could you list what exactly the static information is? I tried searching but didn't find anything.

[Moonchild]

Static information being parts of the extension itself, never user data.

[dark_moon]

Thanks!

With NoScript we can block websites using resource://

Add that as strings in about:config:

Code: Select all

noscript.surrogate.noplugin.exceptions	<EMPTY>
noscript.surrogate.noplugin.replacement	Object.defineProperty(navigator, "plugins", {value: []});
noscript.surrogate.noplugin.sources	@^https?://

Testsite: https://browserleaks.com/firefox

Only the Default Locale can be displayed with that NoScript feature.

[Moonchild]

Um, pale moon 27.4.2 already only shows the locale out of the box on that test site NoScript has no part in it.

[dark_moon]

Youre right

The thread can be closed