1479224 - Don't let add-ons open popup tabs or windows without permission

Status: RESOLVED DUPLICATE of bug 1476020

(WebExtensions :: Frontend, defect)

Description

[bugzilla.m7]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180704194937

Steps to reproduce:

Since a few weeks I get popunder tabs opening to this address:
https://lzpv4rsmat.com/h159kp2r?key=811a4a1d4729a23a23030d82c812ae77

I cannot tell which event triggers the popunder tabs to appear.

I am using 61.0.1 (64-bit) firefox for ubuntu with a 16.04 patched installation.

Is there a way to know which tab/addon/whatever calls the popunder? and why are they allowed at all in the first place?



Actual results:

Those tabs open with no user interaction that I can pinpoint.  


Expected results:

No tab should open without me clicking a link.

Comment 1

[Gingerbread Man]

(In reply to bugzilla.m7 from comment #0)
> Is there a way to know which tab/addon/whatever calls the popunder?

Do you have "Easy YouTube mp3" installed? If so, remove it [1]. If not,

1. Disable half your extensions.
2. If the problem persists, disable half of the remainder.
3. If the problem goes away, enable half of the disabled ones.
4. And so on, until you find the one to blame.

[1] https://discourse.mozilla.org/t/one-of-30-extensions-is-likely-intermittently-hijacking-tabs/30309/22

Comment 2

[bugzilla.m7]

Thanks a lot! 
Yes I have this extension that I just uninstalled, it should fix this case. 

What I don't understand is why firefox allows to open a tab without the user requesting it. IMO there should -at least- be a system parameter to allow this behavior or not.

Comment 3

[Gingerbread Man]

(In reply to bugzilla.m7 from comment #2)
> What I don't understand is why firefox allows to open a tab without the user
> requesting it. IMO there should -at least- be a system parameter to allow
> this behavior or not.

I'll update the summary and move this report. I don't know if there's a permission you grant when installing or updating the add-on, or if it's something add-ons can do without prior notification.

If you want to report an issue with the Firefox Add-ons site policy, send an e-mail to amo-admins (at) mozilla (dot) org. As you can see from the link at comment 1, as far as it's concerned, it seems opening such tabs is considered acceptable behavior for an add-on:
"Version 2.3.1.0 · July 5, 2018 had a feature to “ask for feedback” every 7 days. That included opening the lzpv4rsmat(dot)com
Currently that does not result in automatic rejection and it is left to users to decided if the monetization system deployed by an add-on is desirable or not."

> Thanks a lot! 
> Yes I have this extension that I just uninstalled, it should fix this case. 

You're welcome.

Comment 4

[Kris Maglione [:kmag]]

It seems like these add-ons should be blocklisted. Pop-unders that don't make it clear that they're related to the add-on definitely violate the no surprises policy, at the very least.

Comment 5

[git.m7]

Thanks all for the advice. I have mailed amo-admins to complain about the current policy. 
I also confirm that uninstalling “Easy YouTube mp3” solved the problem.

Comment 6

[Andreas Wagner [:TheOne] [use NI]]

This add-on has been blocked in bug 1476020.