Pale Moon 25.2 changes for extension developers

[Moonchild]

For extension developers for Pale Moon, some small changes will occur now and then for the browser to continue to develop and move forward.

Currently there is one pending (security-related) change that was adopted from Firefox 34 and that will impact some content-manipulating extensions:

• XBL content whitelisting:
  For extensions that apply XBL bindings to untrusted (web) content, the extension now must indicate the following (case-sensitive) keyword in the related XML file for the binding:

  Code: Select all

  bindToUntrustedContent="true"

  Example:

  Code: Select all

  <bindings id="myBindings"
            xmlns="http://www.mozilla.org/xbl"
            xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
    <binding id="myReaderUI" bindToUntrustedContent="true">
      <content>
  ... XUL controls ...
      </content>
      <resources>
        <stylesheet src="chrome://some-path/myReaderUI.css"/>
      </resources>
    </binding>
  </bindings>

  The most obvious extensions impacted are those that provide controls injected in web pages through XBL and for example ad-blocking extensions (ABL had to be updated, for example, to cater to this change).
  
  Once again, unless you are using XBL bindings to web page content, this will most likely not apply to you!

[Freezing Moon]

Is this change going to affect ABP 2.6.4-pm ?
I can't use ABL since it doesn't work with ABP Pop-up Addon.

[Moonchild]

Is this change going to affect ABP 2.6.4-pm ?

The pseudo-static version of ABP you are using will be affected and will no longer properly work. Only ABL will be updated because that is our official fork.
It's also not recommended to keep using the pseudo-static, because of the ABP developers' clear wishes that no such version be published or distributed. I understand you're limited at the moment but there are plans to integrate additional functionality which will make the popup addon-to-the-addon unnecessary.

[New Tobin Paradigm]

For transparency reasons.. the fix was not introduced until Adblock Plus 2.6.5. ABL 3.0.1 (as yet released) will contain this patch (as well as a better 16x16 icon )

LUCKILY due to the little bit of temporary nginx-y logic.. ABL now has update capabilities. You should now have been offered an update to ABL 3.0.0. Please update.

[mikeysc]

Is there a search phrase that would give us a quick idea of which installed extensions this might affect? I tried searching "bindings" for all files in the extensions folder and got lots of hits, then tried the same for just xml files. Some of the hits are extensions that manipulate content but some are UI-related only. Some of the ones I'm using are older ones that are not being updated so that would leave it up to us to fix if they're affected.

[Moonchild]

Is there a search phrase that would give us a quick idea of which installed extensions this might affect? I tried searching "bindings" for all files in the extensions folder and got lots of hits, then tried the same for just xml files. Some of the hits are extensions that manipulate content but some are UI-related only. Some of the ones I'm using are older ones that are not being updated so that would leave it up to us to fix if they're affected.

Not really, since it is really dependent on if the extension uses XBL binding to web content or not.
If extensions were updated for Firefox 34 with similar descriptions, you can bet it was affected, but there's no way to easily get a list. Plenty of extensions use XBL bindings to chrome/UI that aren't a problem -- it's only if it binds in this way to web content.

[Freezing Moon]

ABP 2.6.4-pm (+ ABP Pop-up Addon) is working fine with Pale Moon 25.2.0.