Git/firefox-user.js
1
0
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2025-11-03 23:35:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

FPI: isolate postMessage...

Browse Source
This commit is contained in:
Thorin-Oakenpants
2018-10-28 16:46:22 +00:00
committed by GitHub
parent 5a36b4e016
commit afee555045
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
user.js
View File

@@ -1472,6 +1472,7 @@ user_pref("privacy.sanitize.timeSpan", 0);
** 1344170 - isolate blob: URI (FF55+) ** 1344170 - isolate blob: URI (FF55+)
** 1300671 - isolate data:, about: URLs (FF55+) ** 1300671 - isolate data:, about: URLs (FF55+)
** 1473247 - isolate IP addresses (FF63+) ** 1473247 - isolate IP addresses (FF63+)
** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
NOTE: FPI has some issues depending on your Firefox release NOTE: FPI has some issues depending on your Firefox release
** 1418931 - [fixed in FF58+] IndexedDB (Offline Website Data) with FPI Origin Attributes ** 1418931 - [fixed in FF58+] IndexedDB (Offline Website Data) with FPI Origin Attributes
@@ -1485,8 +1486,14 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
user_pref("privacy.firstparty.isolate", true); user_pref("privacy.firstparty.isolate", true);
/* 4002: enforce FPI restriction for window.opener (FF54+) /* 4002: enforce FPI restriction for window.opener (FF54+)
* [NOTE] Setting this to false may reduce the breakage in 4001 * [NOTE] Setting this to false may reduce the breakage in 4001
* [1] https://bugzilla.mozilla.org/1319773#c22 ***/ * [FF65+] blocks postMessage with targetOrigin "*" if originAttributes don't match. But
user_pref("privacy.firstparty.isolate.restrict_opener_access", true); * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
* [1] https://bugzilla.mozilla.org/1319773#c22
* [2] https://bugzilla.mozilla.org/1492607
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // default: true
// user_pref("privacy.firstparty.isolate.block_post_message", true); // (hidden pref)
/*** 4500: privacy.resistFingerprinting (RFP) /*** 4500: privacy.resistFingerprinting (RFP)
This master switch will be used for a wide range of items, many of which will This master switch will be used for a wide range of items, many of which will