1710749 - Website filter can be bypassed with reader mode

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect, P2)

Description

[Mike Kaply [:mkaply]]

From:

https://github.com/mozilla/policy-templates/issues/767

The Website Filter policy is not always useful if the user can simply add about:reader?url= at the beginning of the URL he/she wants to "unblock".

I already have a case for view-source, just need to add about:reader

Comment 1

[Mike Kaply [:mkaply]]

Attachment: Bug 1710749 - If a website is blocked via policy, block about:reader r?emalysz!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/abb16f9ad6a3
If a website is blocked via policy, block about:reader r=emalysz

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/abb16f9ad6a3

Comment 4

[Mike Kaply [:mkaply]]

Comment on attachment 9221815 [details]
Bug 1710749 - If a website is blocked via policy, block about:reader r?emalysz!

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy only change, parity with beta
• User impact if declined: Pages blocked by policy can be viewed in reader mode
• Fix Landed on Version: 90
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only, has test.
• String or UUID changes made by this patch:

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9221815 [details]
Bug 1710749 - If a website is blocked via policy, block about:reader r?emalysz!

Approved for 78.12esr.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/6cc3d9a3e79c

Comment 7

[Andrei Purice]

Reproduced on Firefox Nightly 90.0a1 (2021-05-11) (20210511093339) on Windows 10.
Verified > Fixed on Firefox Beta 90.0 (20210705185941) and Firefox 78.12.0esr (20210610190845) on Windows 10.