Content Analysis should not check any about: pages
Categories
(Firefox :: Data Loss Prevention, defect)
Tracking
()
People
(Reporter: gstoll, Assigned: gstoll)
References
Details
Attachments
(1 file)
Our "usual" check for whether a page is exempt from DLP is something like BrowsingContext::IsChrome(). On D200979, emilio pointed out that only a few about: pages are loaded in chrome (specifically about:config, about:preferences, and about:support), and the rest are loaded in content.
We think it makes sense to make all about: pages exempt from DLP. Maybe the easiest way is to just add about:.* to the browser.contentanalysis.allow_url_regex_list list.
|
||
Comment 1•3 months ago
|
||
The severity field is not set for this bug.
:handyman, could you have a look please?
For more information, please visit BugBot documentation.
|
||
Updated•3 months ago
|
|
||
Comment 2•1 month ago
|
||
Does that mean someone can exfiltrate a password via about:logins?
|
Assignee | |
Comment 3•1 month ago
|
||
DLP only covers pasting from the clipboard, not copying to the clipboard, so in any case it wouldn't cover this.
|
||
Comment 4•1 month ago
•
|
||
about:logins does support editing passwords and a user could be pasting in an updated password there. We're already considering this a bug, but we'll reconsider whether or not it must go into our 1.0 version.
|
|
Assignee | |
Updated•1 month ago
|
|
|
Assignee | |
Comment 5•1 month ago
|
||
Pushed by gstoll@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/bfb8443208d5 exempt about pages from DLP r=dlp-reviewers,handyman
|
||
Comment 7•27 days ago
|
||
| bugherder | ||
Verified as fixed on Firefox 128.0b1 and on Firefox Nightly 129.0a1 (2024-06-10), using Windows 11. The about: pages (about:logins, about:config, about:preferences, about:addons, about:checkerboard) are exempt from DLP analysis (when using a policies.json that does not alter the pref value - e.g. policies-2.json).
I can also confirm that the browser.contentanalysis.allow_url_regex_list pref is set to ":(?!blank|srcdoc).*" (due to Bug 1901065).
Description
•