evilpie

Re:The Woes of Sanitizing SVGs on Monday April 27, 2026 @01:22PM (#47924513)

The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default.

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

Re:Firefox Has Integrated Brave's Adblock Engine on Saturday April 25, 2026 @03:28AM (#47899472)

> The Firefox team is experimenting with ways to improve the built-in Enhanced Tracking Protection feature in Firefox. This is one of the libraries we're going to experiment with.

> - We are not, and have no plans to abandon MV2 extensions. This will ensure certain types of add-ons, like ad-blockers, continue to work best in Firefox.

> - Firefox supports several ad-blockers as add-ons on Desktop and Android, including uBlock Origin.

> - We are not bundling Brave's ad-blocking system, we're testing one of their open source Rust components to improve how Firefox processes tracker lists.

https://www.reddit.com/r/firefox/comments/1sttf82/firefox_wi...

This is what the official Firefox account had to say when this came up on reddit.

Re:Making Firefox's right-click not suck with about:config on Thursday March 05, 2026 @06:43AM (#47260502)

Yes. It's in about:keyboard.

Re:Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefo... on Tuesday February 24, 2026 @12:25PM (#47139847)

You aren't reading it right.

  new Sanitizer({})

This Sanitizer will allow everything by default, but setHTML will still block elements/attributes that can lead to XSS.

You might want something like:

  new Sanitizer({ replaceWithChildrenElements: ["h1"], elements: [], attributes: [] })

This will replace <h1> elements with their children (i.e. text in this case), but disallow all other elements and attributes.

Re:Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefo... on Tuesday February 24, 2026 @09:47AM (#47137824)

Using an allowlist based Sanitizer you are definitely less likely to shoot yourself in the foot, but as long as you use setHTML you can't introduce XSS at least.

Re:Firefox 148 Launches with AI Kill Switch Feature and More Enhancements on Tuesday February 24, 2026 @03:54AM (#47134615)

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

Re:Element: SetHTML() Method on MDN on Wednesday October 22, 2025 @05:23PM (#45675325)

If you want to use an XSS-unsafe Sanitizer you have to use setHTMLUnsafe.

Re:Element: SetHTML() Method on MDN on Wednesday October 22, 2025 @04:51PM (#45674985)

We enabled this by default in Firefox Nightly (only) this week.

Firefox Security and Privacy newsletter 2025 Q2

Posted by evilpie on Thursday July 17, 2025 @08:00AM
from the attackanddefense.dev dept.

https://attackanddefense.dev/2025/07/17/firefox-security-privacy-newsletter-2025-q2.html

( Read More... | no comments | 2 points | on HN )

Re:Firefox tab groups are here on Wednesday April 30, 2025 @03:41AM (#43842284)

Make sure you have Firefox 138! From the release notes: > You can also now reposition a tab group on the tab bar by dragging it.

Re:Hardening the Firefox Front End with Content Security Policies on Wednesday April 09, 2025 @07:31AM (#43630991)

Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.

https://extensionworkshop.com/documentation/publish/add-on-p...

Re:Hardening the Firefox Front End with Content Security Policies on Wednesday April 09, 2025 @07:30AM (#43630984)

While this is definitely annoying, most of the time this can be worked around by the extension without workarounds that themself weaken security.

For example I helped uBlock Origin out in 2022 when they ran into this: https://github.com/uBlockOrigin/uBlock-issues/issues/235#iss...

Hardening the Firefox Front End with Content Security Policies

Posted by evilpie on Wednesday April 09, 2025 @05:34AM
from the attackanddefense.dev dept.

https://attackanddefense.dev/2025/04/09/hardening-the-firefox-frontend-with-content-security-policies.html

( Read More... | 67 comments | 64 points | on HN )

Re:Firefox tracks you with “privacy preserving” feature on Wednesday September 25, 2024 @03:46AM (#41644817)

If it's disabled (greyed-out), then you already have telemetry disabled.

Re:Show HN: Tiny Chrome extension to disable images to reduce distract... on Saturday June 01, 2024 @06:24PM (#40549602)

Firefox also has the about:config preference permissions.default.image: 2, which will block most images.

Re:Cross My Heart – A Frogger Demake in 256 Bytes of HTML/JS on Sunday February 11, 2024 @04:26PM (#39338896)

The profile actually shows the freeze is not caused by normal JS garbage collection, but by cycle collection. So probably something related to DOM nodes.

Re:Flashpoint Archive on Thursday January 04, 2024 @07:03AM (#38865964)

See also https://ooooooooo.ooo/. "9o3o is an official (but experimental) online version of the Flashpoint Archive."

Re:Fritzbox: AVM is threatened with a sales ban due to violations of H... on Monday December 18, 2023 @07:44AM (#38681673)

https://www.pcgameshardware.de/Internet-Thema-34041/News/AVM...

Also one of the headings was mistranslated horribly.

In linked the article: "AVM threatens to ban the sale of Fritzbox routers". The original in German: "AVM droht Verkaufsverbot für Fritzbox-Router". Right translation is roughly: "AVM is threatened with a ban on the sale of Fritzbox routers".

Re:Half Life:25th Anniversary Documentary on Tuesday November 28, 2023 @08:21AM (#38445400)

See also Dario Casali's Half Life 25yr anniversary playthrough: https://www.youtube.com/playlist?list=PLk5gaNp4x_AVIJviyHueH...

Re:Firefox desktop extensions coming soon for the upcoming Android rel... on Friday August 11, 2023 @05:36AM (#37086786)

Igalia is regularly contracted to work on new Firefox features, so this is already happening.

Re:Firefox 115 Now Available with Intel GPU Video Decoding on Linux on Tuesday July 04, 2023 @11:01AM (#36587587)

Considering the recent controversy it might be interesting to point out that much of this work was done by Redhat employee Martin Stránský over multiple years: https://bugzilla.mozilla.org/show_bug.cgi?id=1610199

Re:More malicious extensions in Chrome Web Store on Thursday June 01, 2023 @08:32AM (#36150223)

As far as I can tell from my own recommended extensions is that every update needs to be approved/reviewed before it's made generally available.

Re:TabFS – a browser extension that mounts the browser tabs as a files... on Saturday February 18, 2023 @02:18PM (#34850098)

> And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken".

It's likely you forgot to include the browser_specific_settings with a some arbitrary id in the manifest.json.

Permanently installing unsigned extensions definitely works in the Developer Edition after setting the pref in about:config.

Re:What’s Going on in the World of Extensions on Tuesday January 17, 2023 @04:57PM (#34419955)

This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features.

Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.

Re:What’s Going on in the World of Extensions on Tuesday January 17, 2023 @04:53PM (#34419893)

Did you ever get around to communicating your use-case to the developers?

Re:How the Clipboard Works on Tuesday October 25, 2022 @04:48AM (#33327904)

> Type starting with x- are non-standard. x-moz- means it’s a mozilla-defined one. There seems to be no standard mime type for a URL

The standard web MIME for url(s) is text/uri-list: https://www.rfc-editor.org/rfc/rfc2483#section-5

Re:YouTubePluginReplacement.cpp: YouTube-specific code in WebKit on Sunday September 18, 2022 @02:13PM (#32889889)

Firefox will also rewrite YouTube embeds: https://searchfox.org/mozilla-central/rev/c6d17806faef8708b6....

Firefox also ships a "system" add-on (https://github.com/mozilla-extensions/webcompat-addon) that has interventions and user-agent overrides for many websites. See for yourself in Firefox on about:compat.

Re:React PDF Viewer on Monday August 22, 2022 @05:20AM (#32549155)

Seems like they don't mention that fact anywhere in the readme or homepage.

Re:Retrospective and technical details on the recent Firefox outage on Wednesday February 02, 2022 @05:36AM (#30175894)

The actual bug was in the C++ code handling the Content-Length header (https://hg.mozilla.org/integration/autoland/rev/48c0e854be62...) and the Rust code just happened to be first to trigger it.

Re:US puts NSO Group on trade blacklist on Wednesday November 03, 2021 @03:51PM (#29099461)

I was wondering if the recent falling out with France had something to do with it. Maybe this is a cheap way to earn some points with Macron after NSO was caught potentially? spying on him/his government.