From d004b26d7f763de5aa8f91e58c794d98f23c7ef8 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 4 Sep 2024 13:59:25 +0200 Subject: [PATCH] [Pale-Moon] Warn before using external handler for usenet protocols We normally ask for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: snews: and nntp:. Since most operating systems in 2024 don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. Of course, all bets are off if a user runs such a program to begin with, but in some situations (looking at you, MacOS!) just downloading/unpacking could already result in registration as a protocol handler without the user actually executing anything. --- application/palemoon/app/profile/palemoon.js | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/application/palemoon/app/profile/palemoon.js b/application/palemoon/app/profile/palemoon.js index c8c136f7ef..c2e1cd2cd5 100644 --- a/application/palemoon/app/profile/palemoon.js +++ b/application/palemoon/app/profile/palemoon.js @@ -625,7 +625,7 @@ pref("browser.xul.error_pages.expert_bad_cert", false); // Work Offline is best manually managed by the user. pref("network.manage-offline-status", false); -// We want to make sure mail URLs are handled externally... +// We want to make sure known external protocol URLs are handled externally. pref("network.protocol-handler.external.mailto", true); // for mail pref("network.protocol-handler.external.news", true); // for news pref("network.protocol-handler.external.snews", true); // for secure news @@ -634,11 +634,11 @@ pref("network.protocol-handler.external.nntp", true); // also news pref("network.protocol-handler.external.ms-windows-store", true); #endif -// ...without warning dialogs +// Configure external handler warning dialogs. pref("network.protocol-handler.warn-external.mailto", false); -pref("network.protocol-handler.warn-external.news", false); -pref("network.protocol-handler.warn-external.snews", false); -pref("network.protocol-handler.warn-external.nntp", false); +pref("network.protocol-handler.warn-external.news", true); +pref("network.protocol-handler.warn-external.snews", true); +pref("network.protocol-handler.warn-external.nntp", true); #ifdef XP_WIN pref("network.protocol-handler.warn-external.ms-windows-store", false); #endif