797139 - blocklist Babylon Toolbar

Status: VERIFIED DUPLICATE of bug 788353

(Toolkit :: Blocklist Policy Requests, defect)

Description

[patrickjdempsey]

User Agent: Mozilla/5.0 (Windows NT 5.0; rv:10.0.7) Gecko/20100101 Firefox/10.0.7
Build ID: 20120824135927

Steps to reproduce:

Search and urlbar hijackers like Babylon Toolbar have begun modifying the user.js file so that the usual "simple" methods of removal are no longer enough:

1. Uninstall Babylon Toolbar, Object Installer, Bprotector, and Browser Manager at the OS level.
2. Remove from Firefox Addons.
3. Remove from Firefox search engines.
4. Remove all "Babylon" entries from about:config.

This now includes:
5. Go into profile and remove "Babylon" entries from user.js.





Expected results:

User.js file should either not be accessible by extensions or created as a read-only file.  In addition, Babylon Toolbar should be blacklisted.

Comment 1

[Dave Garrett]

I'm going to morph this into just the blocklist request. The bug with the as-filed title "User.js should not be accessible by extensions" is not practical. Extensions are programs you install; they can do anything and access any file. If one is malware and on your system there's nothing that can be done to prevent them from doing anything. Screwing around with user.js is the least of your problems.

What exactly is it adding to user.js?

Comment 2

[patrickjdempsey]

I haven't personally been misfortunate enough to have this, but apparently they have begun to set keyword.URL and browser.newtab.url in the user.js so that even after complete removal of their program these preferences will continue to be reset every time the browser is restarted.  This used to be a pretty rare occurrence, but now that a "popular" toolbar has begun to do I wouldn't be surprised to see many many new copy-cats.  

Average and even many "advanced" users are highly unlikely to know what the user.js file is, including many who are aware of about:config.  

But to me this all comes back around to the problem of what to do about 3rd-party extensions installations.  Obviously this is needed for enterprise deployments, but for at-home users I can see no reason to allow other programs to install extensions into Firefox.

Comment 3

[[:Cww]]

This is likely a duplicate if we want to just focus on Babylon. Please undupe and re-summarize if you decide a more broad-reaching approach is needed in terms of all add-ons.

Comment 4

[[:Cww]]

Ooops, wrong bug. I shouldn't triage when I'm tired.