Can remove about:addons

REOPENED
Unassigned

Status

WebExtensions
Untriaged
P3
normal
REOPENED
2 years ago
16 days ago

People

(Reporter: Andy McKay, Unassigned)

Tracking

({sec-low})

Trunk
sec-low

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [triaged])

Attachments

(1 attachment)

607 bytes, application/x-xpinstall
Details
(Reporter)

Description

2 years ago
Created attachment 8786861 [details]
close-about-addons.xpi

We've seen add-ons that do malicious things like blank out about:addons. The intention is to not allow a user to spot the malicious add-on and uninstall it. 

If that about:addons is special, then WebExtensions can similar remove access to about:addons by just closing the tab.

Attached example.
On the upside, users can always start Firefox in safe mode to fix this.

It would definitely be nice to prevent add-ons from doing something like this maliciously, but I'm not sure that we could do it without significantly handicapping tab add-ons, and the like. But maybe we can restrict them so that they can only navigate away from pages like about:addons in response to user input of some sort.
Keywords: sec-low
(Reporter)

Updated

2 years ago
Priority: -- → P5
Whiteboard: [triaged]
(Reporter)

Comment 2

a year ago
I don't think there's much we should do here. WebExtensions aren't perfect, but we also don't want to make them too complicated with these sorts of changes.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → WONTFIX
Group: toolkit-core-security
Duplicate of this bug: 1387818

Updated

3 months ago
Duplicate of this bug: 1455350
I don't know that there's much we should do, but doing nothing leaves a problem open (such as what a block was used for in https://bugzilla.mozilla.org/show_bug.cgi?id=1454691#c0). #c1 makes sense to me, seems like we should see if we can prevent the obvious cases that would befuddle users.

Maybe we should discuss whether or not there's a known subset of things we can guard against, or whether our approach for these myriad kinds of problems should rely on blocklisting.
Status: RESOLVED → REOPENED
Priority: P5 → P3
Resolution: WONTFIX → ---

Updated

3 months ago
See Also: → bug 1455360

Comment 6

3 months ago
If the long term plan is to remove about:addons and move the logic over to about:preferences, perhaps focusing on that page might be the way to go. Since about:preferences is used to show the impact of extensions, that might be a legitimate target anyway.

One other thought I had in relation to moving out of about:addons is moving the add-on data to a location which can not be affected by add-ons at all. Unlike a tab. For example, the jigsaw button in the menu bar could be turned into an add-on listing and WebExtensions cannot remove that.
Any links you can provide for that long-term plan would certainly be helpful for the increasing questions about it. :)
Flags: needinfo?(andy)

Comment 8

3 months ago
If I remember correctly, that's project Medley which Emanuela was working on, they might be able to help.
Flags: needinfo?(andy) → needinfo?(emanuela)

Updated

a month ago
Product: Toolkit → WebExtensions

Comment 9

16 days ago
Yes, there are still plans to leave about:addons *bye bye* and move the managament of extensions in about:preferences. 
Unfortunatly, I cannot provide a proper timeline for this. Maybe David can help us.
status-firefox51: affected → ---
Flags: needinfo?(emanuela) → needinfo?(ddurst)
Prioritization would happen after we have a clear plan, and signoff from the team that owns about:preferences.
Flags: needinfo?(ddurst)
You need to log in before you can comment on or make changes to this bug.