Skip to content

Prevent sites from using external links like mailto. #285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 8 commits into from
Closed

Prevent sites from using external links like mailto. #285

Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0386bf3
Prevent sites from using external links like mailto.
SvobodaJakub Apr 28, 2017
2ab54f2
Prevent sites from using external links like mailto - added reference…
SvobodaJakub Apr 28, 2017
b811530
Prevent sites from using external links like mailto - improved pref w…
SvobodaJakub Apr 28, 2017
6418cb1
Prevent sites from using external links like mailto - improved NOTICE…
SvobodaJakub Apr 28, 2017
d7ff4ec
Prevent sites from using external links like mailto - improved NOTICE…
SvobodaJakub Apr 28, 2017
97bfed7
Prevent sites from using external links like mailto - improved PREF w…
SvobodaJakub Apr 28, 2017
c835b38
Prevent sites from using external links like mailto - clarified comme…
SvobodaJakub Apr 28, 2017
15ece0d
Prevent sites from using external links like mailto - improved based …
SvobodaJakub Apr 28, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions user.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,53 @@ user_pref("general.buildID.override", "20100101");
// https://github.com/pyllyukko/user.js/issues/120
user_pref("browser.display.use_document_fonts", 0);

// PREF: Prevent sites from using links like mailto to launch external applications.
Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be // PREF: Prevent sites from using URLs such as mailto:, irc:, magnet: ... to launch external applications

Copy link
Contributor Author

@SvobodaJakub SvobodaJakub Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the wording suggestions.

// http://kb.mozillazine.org/Network.protocol-handler.external-default
// http://kb.mozillazine.org/Network.protocol-handler.warn-external-default
// https://news.ycombinator.com/item?id=13047883
// https://bugzilla.mozilla.org/show_bug.cgi?id=167475
// NOTICE: Breaks mailto links on legit websites, user has to right-click and copy mail address from the link.
Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently NOTICE: needs to be on the line just after PREF: for the automatic doc generation to work properly :/

Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be // NOTICE: Breaks opening third-party mail/messaging/torrent/... clients by clicking on links with custom protocols

Copy link
Contributor Author

@SvobodaJakub SvobodaJakub Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I generated the readme using gen-readme.sh and the NOTICEs, the PREFs and their URLs were all added correctly to README.md. Am I doing something wrong?

Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry. You are correct. Reference links must go right under the PREF. Everything is fine.

// TODO: Add externally-handled protocols from Windows 8.1 and Windows 10 (currently contains protocols only from Linux and Windows 7) that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
// TODO: Add externally-handled protocols from Mac OS X that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
user_pref("network.protocol-handler.external-default", false);
user_pref("network.protocol-handler.external.irc", false);
user_pref("network.protocol-handler.external.magnet", false);
user_pref("network.protocol-handler.external.mailto", false);
user_pref("network.protocol-handler.external.ms-windows-store", false);
user_pref("network.protocol-handler.external.news", false);
user_pref("network.protocol-handler.external.nntp", false);
user_pref("network.protocol-handler.external.sftp", false);
user_pref("network.protocol-handler.external.snews", false);
user_pref("network.protocol-handler.warn-external-default", true);
user_pref("network.protocol-handler.warn-external.irc", true);
user_pref("network.protocol-handler.warn-external.magnet", true);
user_pref("network.protocol-handler.warn-external.mailto", true);
user_pref("network.protocol-handler.warn-external.ms-windows-store", true);
user_pref("network.protocol-handler.warn-external.news", true);
user_pref("network.protocol-handler.warn-external.nntp", true);
user_pref("network.protocol-handler.warn-external.sftp", true);
user_pref("network.protocol-handler.warn-external.sms", true);
user_pref("network.protocol-handler.warn-external.snews", true);
user_pref("network.protocol-handler.warn-external.tel", true);
user_pref("network.protocol-handler.warn-external.vnd.youtube", true);

// PREF: Disable nonessential protocols from being used altogether.
// http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29
// NOTICE: Breaks all interactions and links using these protocols.
Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

Copy link
Contributor

@nodiscc nodiscc Apr 28, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be // NOTICE: Breaks all interaction with custom protocols such as mailto: irc: magnet: ...

// TODO: Add more protocols, see TODO for the previous PREF.
// network.protocol-handler.expose-all == false breaks some javascript links, hence not used.
user_pref("network.protocol-handler.expose.irc", false);
user_pref("network.protocol-handler.expose.magnet", false);
user_pref("network.protocol-handler.expose.mailto", false);
user_pref("network.protocol-handler.expose.ms-windows-store", false);
user_pref("network.protocol-handler.expose.news", false);
user_pref("network.protocol-handler.expose.nntp", false);
user_pref("network.protocol-handler.expose.sftp", false);
user_pref("network.protocol-handler.expose.sms", false);
user_pref("network.protocol-handler.expose.snews", false);
user_pref("network.protocol-handler.expose.tel", false);
user_pref("network.protocol-handler.expose.vnd.youtube", false);

/******************************************************************************
* SECTION: Extensions / plugins *
******************************************************************************/
Expand Down