Opened 7 years ago

Closed 7 years ago

#2982 closed defect (wontfix)

TBB for Windows 2.2.24-1 alpha searches for system-wide plugins

Reported by: Marty Owned by: erinn
Priority: High Milestone:
Component: Applications/Tor bundles/installation Version:
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Firefox's ability to search the Windows registry path for system-wide plugins and extensions is not disabled!

Compare: https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/README
"disable Firefox's ability to search the Windows registry path for system-wide plugins and extensions (closes: #2118)"

Child Tickets

Change History (10)

comment:1 Changed 7 years ago by Marty

Component: - Select a componentTor Browser
Owner: set to mikeperry

Tor Browser Bundle (2.2.24-1) alpha

comment:2 Changed 7 years ago by Marty

Owner: changed from mikeperry to Marty
Status: newassigned

comment:3 Changed 7 years ago by rransom

Component: Tor BrowserTor bundles/installation
Milestone: Tor Browser Bundle for Windows
Owner: changed from Marty to erinn
Priority: normalmajor
Summary: Do not search for system-wide plugins and extensionsTBB for Windows 2.2.24-1 alpha searches for system-wide plugins
Version: Tor: unspecified

comment:4 in reply to:  description Changed 7 years ago by HG2G

Replying to Marty:

Firefox's ability to search the Windows registry path for system-wide plugins and extensions is not disabled!

Compare: https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/README
"disable Firefox's ability to search the Windows registry path for system-wide plugins and extensions (closes: #2118)"

On my system (Windows XP SP3) TBB 2.2.24-1 alpha does not search for all installed plugins as TBB did before resolution of bug 2218 https://trac.torproject.org/projects/tor/ticket/2118. TBB 2.2.24-1 alpha has the appropriate user_pref setting in prefs.js setting: user_pref("extensions.enabledScopes", 5);.

On my system the only system wide plugin found by TBB 2.2.24-1 alpha is "Foxit Reader Plugin for Mozilla 2.0.0.1102". When testing portable Firefox 4.0 http://portableapps.com/apps/internet/firefox_portable and installed Firefox 4.0 all the system wide plugins are found, see this screen shot: http://i55.tinypic.com/33z2u7c.jpg

So it seems user_pref("extensions.enabledScopes", 5); is working as expected, to a point. I tried other integers to prevent TBB 2.2.24-1 alpha from finding the Foxit plugin, i.e., -1 and 100, but they were not successful (I realize neither of those integers are options for extensions.enabledScopes). As per the bug report 2118 https://trac.torproject.org/projects/tor/ticket/2118 I looked for the file "nsExtensionManager.js" but it does not seem to be used for Firefox 4.

comment:5 Changed 7 years ago by erinn

The "documentation" for this feature is here:
http://mxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1013

I'm happy to hear that it partially works. Did you try '1'? The 5 is meant to be "scope profile" + "scope application" (what the Mozilla people advised), but apparently that is too lenient.

If this doesn't work, it may be new patch time.

comment:6 in reply to:  5 Changed 7 years ago by HG2G

Hi Erinn,

Replying to erinn:

The "documentation" for this feature is here:
http://mxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1013

I'm happy to hear that it partially works. Did you try '1'? The 5 is meant to be "scope profile" + "scope application" (what the Mozilla people advised), but apparently that is too lenient.

If this doesn't work, it may be new patch time.

Thankfully no, it seems a patch is unnecessary because user_pref("extensions.enabledScopes", 1); is working to prevent loading of all system wide plugins, at least on my system :>.

The odd thing is user_pref("extensions.enabledScopes", 1); nor user_pref("extensions.enabledScopes", 5); work to prevent loading of system wide plugins for installed FF 4.0 and portable FF 4.0 (from portable apps). I don't have time right now to look through relevant TBB 2.2.24-1 alpha and/or TorButton alpha settings to find what else is configured to prevent loading system wide plugins; maybe later today I will have time unless you or Mike can shed some light on this subject?

Also, from a quick test it seems setting "extensions.enabledScopes" to '0' prevents loading of all system wide plugins in TBB 2.2.24-1 alpha, but to my understanding that should not be the case ... odd.

Note: This current testing with '1' was done under a guest account, previous testing with '5' '-1' and '100' was done under both admin and guest accounts. I will test '1' under admin account later today, however, the same result should be found with TBB regardless of user account rules (re admin vs guest).

comment:7 Changed 7 years ago by erinn

Status: assignedaccepted

Oh, thank you so much for testing! That's great news. I am pleased that it is a small change.

I don't know offhand why that pref doesn't work alone, but if you want to look through the windows prefs I use, they are here:
https://gitweb.torproject.org/erinn/torbrowser.git/blob/9e2aab2df1b8294e78acab08aa823154f7f9ebb6:/build-scripts/config/windows-4.0.js

Maybe it's some of the user_pref("plugin[...]) stuff?

comment:8 Changed 7 years ago by HG2G

Hi Erinn,

I will check out the prefs shortly, thanks for the link, that makes life easier. On first thought I think you may be correct that it could be from (some?) plugin settings. I will post again if I find the answer. Thanks.

comment:9 Changed 7 years ago by erinn

I'm uploading some new FF4 bundles now and this doesn't seem to work at all on OS X. My sense is that it is optimized for Windows right now, so it might be something we want to poke Mozilla people about.

I've been looking at this page: http://kb.mozillazine.org/Plugin_scanning

Which links to this: http://forums.mozillazine.org/viewtopic.php?p=915796#915796

Which indicates that I can probably go through the all.js in the source, prior to compilation, and just comment out the things I don't like.

comment:10 Changed 7 years ago by mikeperry

Resolution: wontfix
Status: acceptedclosed

It appears that enabledScopes now works on MacOS X. However, it is still too blunt an instrument. See #3547 for the plan for the future. If enabledScopes is still broken on Windows, we don't really care, since we want to focus on providing a way to only search for flash..

Note: See TracTickets for help on using tickets.