2015079 - Set dom.keyboardevent.init_key_event.enabled_in_addons to false by default on all channels

Status: RESOLVED FIXED

(WebExtensions :: General, task, P1)

Description

[Rob Wu [:robwu]]

We recently received a report of 1Password 4.x being broken in 147. This version of 1Password was discontinued by its author 3 years ago
2013772 and was broken because it relied on a non-standard feature. After the deprecation in Firefox 93, so we introduced a temporary preference to re-enable its functionality together with outreach to the 1Password developers (bug 1725232). Although a fix was alleged to be available for 1Password Classic, it was never published, so up to Firefox 146, those users had to rely on the specific work-around in Firefox that we introduced back then.

In bug 1848384 we unintentionally set the pref to false by default from Firefox 147.
Bug 2013772 reports that 1Password 4.x broke in Firefox 147, and I did an analysis to assess the impact, summarized at https://bugzilla.mozilla.org/show_bug.cgi?id=2013772#c15

After some discussion with my team, we decided to default the pref to false everywhere by default, which is the first step towards fully removing the deprecated functionality from Firefox. 1Password 4.x's autofill will continue to be broken as a result (a manual work-around remains available for now). This loss of functionality is likely the least of the user's problems, as the use of unmaintained software is a security risk. 1Password 4.x having been unsupported for 3 years and counting, and in the other bug I wrote the following:

Being unmaintained for so long comes with risks of the product breaking altogether, and (severe) security vulnerabilities not being patched. For example, a security researcher recently disclosed vulnerabilities (https://marektoth.com/blog/dom-based-extension-clickjacking/) that affected many password managers one way another, including 1Password. 1Password 4.x was not explicitly tested, but it is very likely vulnerable. To users reading this, I strongly recommend you to export your data from 1Password 4.x to a newer version or a different password manager.

In the meantime, a work-around to this bug is to visit about:config and set dom.keyboardevent.init_key_event.enabled_in_addons to true . But this work-around is not guaranteed to be supported forever.

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 2015079 - Default dom.keyboardevent.init_key_event.enabled_in_addons to false

Comment 2

[Rob Wu [:robwu]]

Firefox 148 is currently on late beta, so the pref is now already false by default.

On the beta channel (148), the value of the pref (diff) is @IS_EARLY_BETA_OR_EARLIER@. Last week we already entered late beta, so that preference evaluates to false now. When 148 goes to release, the pref value will still be false. So we don't need to do uplifts, and let the above patch ride the train.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e9807fdca752
https://hg.mozilla.org/integration/autoland/rev/917c1b322ee4
Default dom.keyboardevent.init_key_event.enabled_in_addons to false r=rpl

Comment 4

[amarc]

https://hg.mozilla.org/mozilla-central/rev/917c1b322ee4