mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-10-08 00:07:30 +09:00
d004b26d7f
We normally ask for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: snews: and nntp:. Since most operating systems in 2024 don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. Of course, all bets are off if a user runs such a program to begin with, but in some situations (looking at you, MacOS!) just downloading/unpacking could already result in registration as a protocol handler without the user actually executing anything. |
||
|---|---|---|
| .. | ||
| macbuild/Contents | ||
| profile | ||
| application.ini | ||
| blocklist.xml | ||
| macversion.py | ||
| Makefile.in | ||
| module.ver | ||
| moz.build | ||
| nsBrowserApp.cpp | ||
| palemoon.exe.manifest | ||
| permissions | ||
| splash.rc | ||
| ua-update.json | ||