RequestPolicy/requestpolicy — Issue #131: conflict with firefusk
Author: jsamuel
Created: 2011-12-22 18:54:38+00:00
State: open
Labels: extension

imported trac ticket
created: 2010-08-31 08:58:19
reporter: justin

User C.M. reports a conflict with the extension firefusk:

https://addons.mozilla.org/de/firefox/addon/2087/

C.M. also mentioned that a similar extension, Pilfer, works fine:

https://addons.mozilla.org/de/firefox/addon/11387/

Both of these extensions open a new window to display images. The differences is that firefusk opens an about:blank window whereas Pilfer opens a chrome://pilfer/ window. Requests from about:blank are blocked, but requests from chrome: are allowed.

The security-sacrificing workaround for the moment would be to allow all from about:blank. The author of firefusk could alternately change their extension so that the displayed images have a chrome: origin or, alternatively, use the nsIRequestPolicy interface exposed by RP to tell RP that each image is allowed before it initiates the request.

More discussion of whitelisting about:blank can be found in #72. Other extensions with similar about:blank issues are discussed in #18 and #55.