661961 - Get rid of plugin.expose_full_path pref and expose plugin paths in a chrome-only interface

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Dave Garrett]

The plugin.expose_full_path pref was added in bug 88183 to allow navigator.plugins to expose the full path to the plugin file in the filesystem. Basically a privacy and security hole was fixed but a pref was added to allow you to manually re-open that hole. A better route would have been to only allow about:plugins access to the path, but it's just a page with normal privileges so a fair bit of a rewrite would've been required. So, the quick and simple hack won the day.

There is no real reason for a website to have access to this information and flipping this pref on can greatly increase fingerprintability and possibly expose your username in your OS if the path includes it.

A much better option would be to add the plugin path to either about:addons or about:support. As this information is only really needed in a few support-related situations, the later makes more sense. The most logical route would be to scrap about:plugins entirely and just add a new plugins section to about:support (see bug 638769) potentially also adding the paths there by amending nsIPluginHost or AddonManager instead of using navigator.plugins (which would also have the added benefit of showing disabled plugins, whereas the current method of using navigator.plugins does not).

Comment 1

[Tom S [:evilpie]]

Attachment: wip

Comment 2

[Tom S [:evilpie]]

This adds an extra row "Path:" to about:plugins. Maybe this should just be combined with "File:"? I tried to make the same change to the about:addons details view, but I had problems with actually finding that code.

Comment 3

[Tom S [:evilpie]]

Please ignore the change to getHSTSPreloadList.js. :)

Comment 4

[WildcatRay]

By the way, is the title supposed to be "Get rid of..." instead of "Gid rid of..."

Comment 5

[Dave Garrett]

(In reply to Ray Murphy (WildcatRay) from comment #4)
> By the way, is the title supposed to be "Get rid of..." instead of "Gid rid
> of..."

Of course it is. That's a dumb typing fail on my part... :/

Comment 6

[Georg Fritzsche [:gfritzsche]]

(In reply to Tom Schuster [:evilpie] from comment #2)
> This adds an extra row "Path:" to about:plugins. Maybe this should just be
> combined with "File:"?

I think it's probably better to have a separate row for the path, both for testability and readability.

Apropos testability: this probably also needs a Mozmill update like bug 831533.

Comment 8

[Benjamin Smedberg]

Comment on attachment 714896 [details] [diff] [review]
wip

While you're touching this code: the current title of "about:plugins" is "Enabled Plugins" but that's no longer accurate; we include all plugins. Can you fix that?

The getHSTSPreloadList.js change isn't related to this patch, right?

Comment 9

[Tom S [:evilpie]]

Attachment: v1

Great, let's do this.

Comment 10

[Mike de Boer [:mikedeboer]]

Tom,

Comment 11

[Mike de Boer [:mikedeboer]]

Ahum. What I wanted to say is that I attached a patch to the bug report I added here as 'See also'. Does this interfere with your work at all?

Comment 12

[Tom S [:evilpie]]

I removed the changes to the title, because they were not actually effective.
https://hg.mozilla.org/integration/mozilla-inbound/rev/abeabcfe18fb

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/abeabcfe18fb

Comment 15

[Dave Garrett]

Can this get uplifted to Firefox 21 beta? There's currently no way for a user to look up a plugin's path without this as the pref is broken there.

Comment 16

[Benjamin Smedberg]

No, this will not be uplifted (21 final is already built).

Comment 17

[byzod]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #16)
> No, this will not be uplifted (21 final is already built).

Will this patch land on 22 beta?

Comment 18

[Georg Fritzsche [:gfritzsche]]

(In reply to byzod from comment #17)
> Will this patch land on 22 beta?

It already is in 22 (and hence in the current beta).