#1 Mark some about: URIs as trusted

Open
opened 7 years ago by platform · 1 comments
platform commented 7 years ago

Currently the extension considers all about: URIs as untrusted. This breaks Clean Uninstall which depends on about:addons being able to access resource: URIs. However, some about: URIs are indeed untrusted:

  • about:blank
  • about:srcdoc

And since WHATWG may add a new Web-accessible about: URI to their standards, we want to use whitelisting, rather than blacklisting.

Currently the extension considers all `about:` URIs as untrusted. This breaks [Clean Uninstall](https://addons.mozilla.org/en-US/firefox/addon/clean-uninstall/) which depends on `about:addons` being able to access resource: URIs. However, some about: URIs are indeed untrusted: * `about:blank` * `about:srcdoc` And since WHATWG may add a new Web-accessible `about:` URI to their standards, we want to use whitelisting, rather than blacklisting.
platform commented 7 years ago
Owner
* Whitelisted: `about:addons` https://addons.mozilla.org/en-US/firefox/addon/no-resource-uri-leak/versions/0.2.0
Sign in to join this conversation.
No Milestone
No assignee
1 Participants
Loading...
Cancel
Save
There is no content yet.