Closed Bug 1589871 Opened 5 years ago Closed 5 years ago

'view-source' URLs can not be proxied by extensions

Categories

(WebExtensions :: Request Handling, defect)

Product:
WebExtensions
Component:
Request Handling
Version:
69 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 1439163

People

(Reporter: xdavid, Unassigned)

Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

I noticed a bug while using an extension named FoxyProxy, made for managing proxy settings, where I set a '*' pattern to proxy every URL.

Actual results:

The URLs beginning with 'view-source' did not get proxied and used the default network settings.

Expected results:

The request should have matched the '*' pattern and because of that, should have gone through the proxy specified.

I reported this issue to the FoxyProxy team, and they responded with saying that Firefox does not provide extensions a way to proxy 'view-source' URLs. They requested me to open a report here.

I am marking this as a security issue (feel free to change if its not applicable) since most people use these extensions to proxy their traffic over a VPN or other privacy enhancing proxy, and 'view-source' sending the request over the default network config could leak sensitive data.

This looks like a duplicate of bug 1439163 to me. Kris/Shane, can you doublecheck and dupe if so?

Component: Untriaged → Request Handling
Flags: needinfo?(mixedpuppy)
Flags: needinfo?(kmaglione+bmo)
Product: Firefox → WebExtensions

Interesting, I am unable to remove the security flag.

Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Flags: needinfo?(mixedpuppy)
Resolution: --- → DUPLICATE
Group: firefox-core-security
Flags: needinfo?(kmaglione+bmo)
You need to log in before you can comment on or make changes to this bug.