mirror/arkenfox-user.js
1
1
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2024-11-18 09:36:39 +01:00
Code Issues Wiki

spring cleaning, part 3: see #716

Browse Source
This commit is contained in:
Thorin-Oakenpants 2019-05-05 17:28:47 +00:00 committed by GitHub
parent da4cfce10f
commit 473e88c784
Signed by: GitHub
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
user.js
View File

@ -302,9 +302,7 @@ user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozi
* This is a real-time check with Google services
* [SETUP-SECURITY] If you do not understand this, or if you want this protection, then override it ***/
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
/* 0403: disable data sharing [FF58+] ***/
user_pref("browser.safebrowsing.provider.google4.dataSharing.enabled", false);
/* 0404: disable 'ignore this warning' on Safe Browsing warnings
/* 0403: disable 'ignore this warning' on Safe Browsing warnings
* If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
* [TEST] see github wiki APPENDIX A: Test Sites: Section 5
* [1] https://bugzilla.mozilla.org/1226490 ***/
@ -1252,9 +1250,6 @@ user_pref("extensions.autoDisableScopes", 15);
/* 2662: disable webextension restrictions on certain mozilla domains (also see 4503) [FF60+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
// user_pref("extensions.webextensions.restrictedDomains", "");
/* 2663: enable warning when websites try to install add-ons
* [SETTING] Privacy & Security>Permissions>Warn you when websites try to install add-ons ***/
user_pref("xpinstall.whitelist.required", true); // [DEFAULT: true]
/** SECURITY ***/
/* 2680: enable CSP (Content Security Policy)
@ -1263,11 +1258,6 @@ user_pref("security.csp.enable", true); // [DEFAULT: true]
/* 2682: enable CSP 1.1 experimental hash-source directive [FF29+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 ***/
user_pref("security.csp.experimentalEnabled", true);
/* 2683: block top level window data: URIs [FF56+]
* [1] https://bugzilla.mozilla.org/1331351
* [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
* [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ ***/
user_pref("security.data_uri.block_toplevel_data_uri_navigations", true); // [DEFAULT: true]
/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save
* [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
* [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
@ -1308,14 +1298,6 @@ user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+]
* [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2)
* [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed ***/
// user_pref("network.cookie.lifetimePolicy", 2);
/* 2705: disable HTTP sites setting cookies with the "secure" directive [FF52+]
* [1] https://developer.mozilla.org/Firefox/Releases/52#HTTP ***/
user_pref("network.cookie.leave-secure-alone", true); // [DEFAULT: true]
/* 2706: enable support for same-site cookies [FF60+]
* [1] https://bugzilla.mozilla.org/795346
* [2] https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
* [3] https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/ ***/
// user_pref("network.cookie.same-site.enabled", true); // [DEFAULT: true]
/* 2710: disable DOM (Document Object Model) Storage
* [WARNING] This will break a LOT of sites' functionality AND extensions!
* You are better off using an extension for more granular control ***/
@ -1330,9 +1312,6 @@ user_pref("network.cookie.leave-secure-alone", true); // [DEFAULT: true]
user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true]
/* 2730: disable offline cache ***/
user_pref("browser.cache.offline.enable", false);
/* 2730b: disable offline cache on insecure sites [FF60+]
* [1] https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ ***/
user_pref("browser.cache.offline.insecure.enable", false); // [DEFAULT: false in FF62+]
/* 2731: enforce websites to ask to store data for offline use
* [1] https://support.mozilla.org/questions/1098540
* [2] https://bugzilla.mozilla.org/959985 ***/