Closed Bug 1346505 Opened 3 years ago Closed 3 years ago

Address bar search disabling with "about:config keyword.enabled = false" does not work if the text contains "google"


(Firefox :: Untriaged, defect)

52 Branch
Not set





(Reporter: rw, Unassigned)


User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170302120751

Steps to reproduce:

I have about:config keyword.enabled = false, so this should change the default of not sending text to a search engine site if it is not recognised as a valid URL.  (See Bug 583961 for why this default behavior is a privacy and security threat.)  I deleted all the search engine providers except DuckDuckGo.  

Typing "abcdef" into the address bar is fine: nothing is sent to any external site.  But if I type "abcdef google" then Firefox starts up a DuckDuckGo session, sending this as the search text.

Actual results:

Text pasted into the address bar is sent to an external site - typically a search engine provider which may use it in various ways, all of which are contrary to the wishes of the user if they accidentally pasted something sensitive to the address bar and hit enter, which I do frequently.  The text could be an entire private message, accidentally in the clipboard when I thought that a valid URL was in the clipboard, before pasting and hitting Enter.  It could contain usernames, passwords, personal messages or whatever.

Expected results:

Firefox should not have started a session with an external site and sent the text to that site.
Closed: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1318070
You need to log in before you can comment on or make changes to this bug.