1239836 - Application Reputation should honor browser.safebrowsing.allowOverride

Status: RESOLVED DUPLICATE of bug 1894373

(Toolkit :: Safe Browsing, defect, P3)

Description

[François Marier [:francois]]

The browser.safebrowsing.allowOverride pref was added in bug 1226490 to disable users' ability to ignore Safe Browsing warnings.

We should disable the "unblock" action on downloaded malware when that pref is enabled.

Comment 1

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 2

[Manish [:manishkk]]

What exactly I need to do in this bug?

https://searchfox.org/mozilla-central/search?q=browser.safebrowsing.allowOverride&case=false&regexp=false&path=

Comment 3

[François Marier [:francois]]

Essentially, if that pref is enabled, then the UI for ignoring a blocked download should not be available.

If you have any other questions, please NI :dimi since I'm no longer working on Firefox.

Comment 4

[Manish [:manishkk]]

:dimi

(In reply to Manish [:manishkk] from comment #2)

What exactly I need to do in this bug?

https://searchfox.org/mozilla-central/search?q=browser.safebrowsing.allowOverride&case=false&regexp=false&path=

Comment 5

[Dimi Lee [OOO 19.Oct - 23.Oct]]

(In reply to Manish [:manishkk] from comment #4)

:dimi

Comment 3 by Francois already explained the idea of this bug, if you still have any question, you can ask and ni me again

Comment 6

[Manish [:manishkk]]

I got only these 2 lines where pref is true.

https://searchfox.org/mozilla-central/source/browser/components/safebrowsing/content/test/browser_bug400731.js#50
https://searchfox.org/mozilla-central/source/modules/libpref/init/all.js#5596

These should be 'false' or anything else?

Comment 7

[Dimi Lee [OOO 19.Oct - 23.Oct]]

(In reply to Manish [:manishkk] from comment #6)

I got only these 2 lines where pref is true.

https://searchfox.org/mozilla-central/source/browser/components/safebrowsing/content/test/browser_bug400731.js#50
https://searchfox.org/mozilla-central/source/modules/libpref/init/all.js#5596

These should be 'false' or anything else?

No, this bug doesn't mean to change the preference. Instead, we should honor the value of the preference.
That means you will need to find out where to disable the UX checkbox to "uncheck block download"

Comment 8

[Jayati Shrivastava]

Hello, May I work on this?

Comment 9

[Jayati Shrivastava]

Which checkbox exactly are we talking about here?

Comment 10

[Jayati Shrivastava]

Attachment: checbox.png

Is it this?

Comment 11

[Jayati Shrivastava]

Attachment: Bug 1239836 - Do not let user uncheck "Block dangerous and deceptive content" and related checkboxes when safe browsing override is disabled. r=dimi

Comment 12

[Dimi Lee [OOO 19.Oct - 23.Oct]]

(In reply to Jayati Shrivastava from comment #10)

Created attachment 9138299 [details]
checbox.png

Is it this?

Yes! Thank you for your help

Comment 13

[BugBot [:suhaib / :marco]]

This good-first-bug hasn't had any activity for 6 months, it is automatically unassigned.
For more information, please visit auto_nag documentation.

Comment 14

[Dan Mehic]

The request in comment 0 — not offering the unblock action on a blocked download when browser.safebrowsing.allowOverride is false — landed in bug 1894373 ("Setting DisableSecurityBypass->Safebrowsing to false should remove the 'Allow download' button"), fixed 2026-05-27.

Current state in mozilla-central:

• browser/components/downloads/content/downloads.js#1755 sets unblockButton.hidden when the pref is false.
• browser/components/downloads/DownloadsViewUI.sys.mjs#211 and #1114 gate the unblock affordance on the same pref via the safeBrowsingAllowOverride lazy getter.

Note that comment 7 onwards drifted toward a different ask: disabling the "Block dangerous and deceptive content" checkboxes in about:preferences. That is separate from comment 0, and enterprise policy already locks those prefs (Policies.sys.mjs#1321). If it is still wanted, it should be filed as its own bug rather than kept here.