s83/user.js
1
0
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2025-04-29 13:33:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

added formfill bugs

Browse source 
The original bug is very old and dead, maybe its still reproducible but I couldnt do it

But there are two new bugs, one about the clarification that the formdata will not be separated by URL origin, which could be a security risk, and another one about some weird bug with wrong input, when using some weird keyboard.

If this is such a vulnerable component, its probably best to keep it off
This commit is contained in:
trytomakeyouprivate 2023-10-27 00:49:42 +00:00 • committed by GitHub
parent 35e8def0b1
commit dff6372b2b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
user.js
View file

@ -337,7 +337,9 @@ user_pref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: fa
* [NOTE] We also clear formdata on exit (2811)
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
* [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
* [2] https://bugzilla.mozilla.org/381681 ***/
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1487441 Formfill will not be restricted to origin
* [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1629520 Virtual keyboards can cause wrong infos to be put in
* [4] https://bugzilla.mozilla.org/381681 very old bug, reproducability questionable, tricky sites could get formfill data***/
user_pref("browser.formfill.enable", false);
/* 0815: disable tab-to-search [FF85+]
* Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search