1896544 - Enforce `about:config`'s `permissions.default.image=2`

Status: UNCONFIRMED

(Fenix :: Browser Engine, enhancement)

Description

[2002luvabbaluvu]

User Agent: Mozilla/5.0 (Android 14; Mobile; rv:125.0) Gecko/125.0 Firefox/125.0

Steps to reproduce:

Goto about:config
Put "default.images"=2
Tested on the most new versions of Firefox and Firefox Beta, both from Google Play Store.
Had to use a workaround on Firefox just to set this:
https://bugzilla.mozilla.org/show_bug.cgi?id=1813163

Actual results:

Social media was always full of actual warfare, waged through infected images,
but now almost the entire Internet is.
Even Google (or one of its developers) has gone missing and is now showing infected images on the results pages at https://google.com/ with "default.images"=2

Expected results:

Should block this for us.
Instead, must ditch Firefox and switch to a text browser such as eLinks or Lynx.

Comment 1

[2002luvabbaluvu]

elinks2 was not bad, but Termux gives "Unable to locate package elinks2", so for Android am stuck with elinks or lynx (pkg install lynx) until Firefox fixes this.

Comment 2

[2002luvabbaluvu]

Firefox was the last fix but now that most of the hosts have gone missing/gotten involved in school shooting, only text browsers can secure us.
From https://stackoverflow.com/questions/604666/elinks-or-lynx
Elinks has more features than Lynx, so apt-get install elinks is the last fix.

Comment 3

[jackyzy823]

Even Google (or one of its developers) has gone missing and is now showing infected images on the results pages at https://google.com/ with "default.images"=2

The first page of image result from google is encoded as a data uri image.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[2002luvabbaluvu]

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #4)

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.
Is severe enough to consider switching to a text browser (such as Elinks or Lynx), because Firefox was the last visual browser which could secure us.

(In reply to jackyzy823 from comment #3)

Even Google (or one of its developers) has gone missing and is now showing infected images on the results pages at https://google.com/ with "default.images"=2

The first page of image result from google is encoded as a data uri image.

So sad since the solution is so simple (just move checks from network-layer to DOM to block infected images for us)

Comment 6

[eternalbluebullrun]

This defect is a major security threat. Almost every website is broadcasting infected images, even with "permissions.default.images=2" (which was the only method to disable images on Firefox.) + "Website Permissions > Autoplay > Block audio and video".
Even Amazon has infected images/videos which are bypassing this: https://www.amazon.com/Bingfu-External-Antenna-Verizon-T-Mobile/dp/B07BQ44CW1
It appears that the only choice left to secure us is to uninstall Firefox and switch to a text browser (such as Elinks or Lynx.)

Comment 7

[2002luvabbaluvu]

The those at risk of epilepsy, the one fix was "permissions.default.images=2"
Priority: public health concern, please fix "permissions.default.images=2"

Comment 8

[2002luvabbaluvu]

The first result for +"about:config" disable URI images
is https://support.mozilla.org/en-US/questions/1226175 which says

You can disable images on the   about:config  page :

Type   about:config   in the address bar and press Enter  (accept the risk,  if asked)
Type in the search bar :   permissions.default.image
and set its value to    2

which does not make it stop
+

If you want to disable the loading of images per site :
Click on the Page Info icon  (little  i   in a circle at the left end of the address bar)  -   click on the little black arrow,  then on  'More Information'.
Under the  Permissions tab,  scroll down to  'Load images' 

which also does not make it stop

Comment 9

[2002luvabbaluvu]

Correction: Permissions tab, scroll down to 'Load images' flat out does not exist

Comment 10

[2002luvabbaluvu]

For those with epilepsy it is a major health concern to not have an option to disable images, such as "permissions.default.image=2".
"permissions.default.image=2" was a fix, but lots of websites (such as https://google.com/) are now bypassing this.
Lots of other websites are bypassing this to force infected ads to show up.
Unless there is a fix, must suggest epilepsy victims to switch to text browsers.

Comment 11

[2002luvabbaluvu]

https://wikipedia.org/wiki/Text-based_web_browser is the sole fix

Comment 12

[2002luvabbaluvu]

(In reply to 2002luvabbaluvu from comment #10)

For those with epilepsy it is a major health concern to not have an option to disable images, such as "permissions.default.image=2".
"permissions.default.image=2" was a fix, but lots of websites (such as https://google.com/) are now bypassing this.
Lots of other websites are bypassing this to force infected ads to show up.
Unless there is a fix, must suggest epilepsy victims to switch to text browsers.

https://bugzilla.mozilla.org/show_bug.cgi?id=1913360 shows how to switch from Google to Yahoo.
Yahoo is the last engine which continues to follow permissions.default.images=2

Comment 13

[2002luvabbaluvu]

Possible fix; about:config's javascript.enabled=false