36484 - Don't hit any server other than the main one

Status: NEW

(Core :: Security, enhancement, P3)

Description

[Ben Bucksch (:BenB)]

We have "Don't accept foreign cookies" and now also "Don't accept foreign
images" preferences. The latter /might/* be nice for ads, but doesn't help with
security: There still might be an embedded object, stylesheet or whatever will
be invented in the future referenced by the page.

I only what to load such files from the server (or site at most), which
delivered the page. You could remove the "no foreign images prefs" in favor of
this new pref, I think.

This bug is a superset of bug #28327.

*doubleclick already has a workaround for both prefs - if I'm right, they
sometimes redirect complete sites to them

Comment 1

[Matthew T (active 1999-2002)]

I was wondering when this would come up ...

Rather than having one general set of prefs for foreign objects, and then special 
prefs just for images, you probably want to change the prefs related to `images' 
into prefs related to `objects' or `items'. This would cover images, applets, 
plugins, style sheets, whatever.

Comment 2

[John Unruh]

Changing component.

Comment 3

[Ben Bucksch (:BenB)]

junruh,
component "Preferences" is about the Prefs window (see
<http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser>. This is a
privacy bug. Back to Sec. Gen.

mpt,
that's exactly what I suggested.

Comment 4

[Daniel Veditz [:dveditz]]

Changing fictional "M30" to reality

Comment 5

[Stephen P. Morse]

.

Comment 6

[A. Craig West]

I definitely agree that a pref like this would be good. I also wouldn't mind if the 
similar image pref was just considered a sub-set of this one, although there are
badwidth issues which might cause a user to wish to block images but not other
objects.