1554226 - Add new Safe Browsing categories.

Status: NEW

(GeckoView :: General, enhancement, P3)

Description

[Arturo Mejia [:amejia]]

We are not handling some safe browsing categories that we do on desktop. They are not actually working on Fennec either, but worthwhile to see if we need them to be introduced.

• Malware in iframe (This works on Chrome)
• Malware warning due to bad assets: [ small img, medium img, large img, css, js]
• Billing warning (This one doesn't work on Desktop but works on Chrome)

Fenix related issue: https://github.com/mozilla-mobile/fenix/issues/2397#issuecomment-495625700

Comment 1

[Chris Peterson [:cpeterson]]

Eugen, do we need to support these new Safe Browsing categories for Fenix MVP or Fennec? Will they require a GV API change for the app to selectively enable the new categories?

Comment 2

[Eugen Sawin [:esawin]]

Testing with latest GV and Chrome 74:

• Malware in iframe

Only blocked by Chrome.

• Malware warning due to bad assets: [ small img, medium img, large img, css, js]

Not Blocked by Chrome.

• Billing warning

Only blocked by Chrome.

GV behaves consistently with Chrome for non-blocked resources and with Firefox desktop for resources blocked only by Chrome.
I think this is working as expected. We might want to revisit our SB blocklist selection, but that's out-of-scope for GV, we're just using Gecko's configuration.

(In reply to Chris Peterson [:cpeterson] from comment #1)

Eugen, do we need to support these new Safe Browsing categories for Fenix MVP or Fennec? Will they require a GV API change for the app to selectively enable the new categories?

This doesn't need to block Fenix. Should Gecko (desktop) introduce new blocklists, then API changes may be required, depending on how they bundle the new lists.

Ethan, are there any plans to revisit our Safe Browsing blocklist selection for mobile? Is there a process to evaluate the quality of our Safe Browsing implementation for specific platforms?

Comment 3

[Ethan Tseng [:ethan]]

(In reply to Eugen Sawin [:esawin] from comment #2)

Ethan, are there any plans to revisit our Safe Browsing blocklist selection for mobile? Is there a process to evaluate the quality of our Safe Browsing implementation for specific platforms?

Hi Eugen,
From my understanding, technically, it's possible to use different Safe Browsing blocklists for desktop and mobile, but currently, we make them identical. When Firefox requests list update for Safe Browsing, the Google server might respond with different results according to the platform specified in the request. I guess that's why Arturo saw different blocking results between desktop and mobile. If necessary, the Safe Browsing module owner Dimi could help to verify this assumption.

Since we use the same categories and lists for desktop and mobile, we don't have a process for evaluation for specific platforms.

When Google introduces a new Safe Browsing category, they usually inform us, and we'll add it to Firefox. It seems Google does not officially release the billing warning category mentioned in comment 0, so we didn't add it yet. Again, Dimi can help verify it if necessary.

Comment 4

[Karl Dubost💡 :karlcow]

Hello,
This maybe related, but we currently have a webcompat issue.
https://github.com/webcompat/web-bugs/issues/90430

The site https://wap.sogou.com/ fails to load on Firefox Fenix on Android, while loading on Desktop with Firefox Android UA on rdm.
Some resources are being blocked for security reasons, but only on Android.
You can test this with
https://dlweb.sogoucdn.com/wapsearch/static/css/index.0721ea75.css

Comment 5

[Chris Peterson [:cpeterson]]

Tasks and enhancements should have severity N/A.