1953088 - Flip the pref to only run SafeBrowsing classification on top-level contexts

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, task)

Comment 1

[Tim Huang[:timhuang]]

Attachment: Bug 1953088 - Enable browser.safebrowsing.only_top_level. r?dimi!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1657364abdf0
Enable browser.safebrowsing.only_top_level. r=dimi

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/1657364abdf0

Comment 4

[Daniel Veditz [:dveditz]]

from comment 0

No description provided.

Can you provide any more information or a reference to the reasoning behind this change? Early on, our SafeBrowsing performance was criticized because we did NOT check iframes and didn't block sites that Chrome did. It is quite common that normal sites get hacked to inject a script or malicious iframe: for example, a flaw discovered in a wordpress plugin or similarly common site-building framework means thousands of sites can be hacked, and will stay hacked until they eventually upgrade their software even after the underlying flaw is fixed.

Comment 5

[Tim Huang[:timhuang]]

The Google SafeBrowsing team has requested this change because they optimize their lists so that the SafeBrowsing requests are only made for top-level loading. They mentioned that there was a loading performance issue because of the SafeBrowsing classification, so they changed their lists.

Google SafeBrowsing team claims that the protection is the same because they will block the top-level domain if a malicious script is injected. So, the site will still be blocked and won't regress the protection.