1268370 - Allow to apply "chrome.webRequest" filters for about: URIs

Status: RESOLVED WONTFIX

(WebExtensions :: Untriaged, defect)

Description

[YUKI "Piro" Hiroshi]

Attachment: disableaboutconfig.xpi - experimental version with WebExtensions

For enterprise use I developed an addon to block loading of "about:config". I've tried to migrate the addon from XUL-based to WebExtensions but it is impossible, because "about:" URIs cannot be ooerated by "chrome.webRequest" APIs.

Steps to reproduce:
1. Ctrl-Shift-J to open the browser console.
2. Install the addon attached.

Actual result:
Errors are reported with the message: "Invalid match pattern: 'about:config'"

Expected result:
No error, and "about:config" is blocked as expected.

Comment 1

[YUKI "Piro" Hiroshi]

The source:

manifest.json
------------------------------------------
{
  "manifest_version": 2,
  "name": "Disable about:config",
  "version": "2.0a1",
  "description": "Disable about:config.",
  "applications": {
    "gecko": {
      "id": "[e-mail]",
      "strict_min_version": "48.0a1"
    }
  },
  "background": {
    "scripts": [
      "background/blocker.js"
    ]
  },
  "permissions": [
    "webRequest",
    "webRequestBlocking",
    "about:config"
  ]
}
------------------------------------------

background/blocker.js
------------------------------------------
/*
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
*/

chrome.webRequest.onBeforeRequest.addListener(
  function(aDetail) {
    return {
      redirectUrl: 'data:text/plain,'
    };
  },
  {
    urls: [
      'about:config'
    ]
  },
  [
    'blocking'
  ]
);
------------------------------------------

Comment 2

[YUKI "Piro" Hiroshi]

Otherwise I need something new API to control availability of Firefox's configuration feature. MCD (Mission Control Desktop) provides ability to lock specified preferences, but it is nonsense to lock all preferences for the purpose.

Comment 3

[:shell escalante]

webrequests accessing about:URL's is a huge security risk that we are not implementing

Comment 4

[YUKI "Piro" Hiroshi]

Then, how we disable about:config in enterprise use?

Comment 5

[YUKI "Piro" Hiroshi]

I've opened another bug 1271367 to report the essential problem of this bug.