mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-10-08 00:07:30 +09:00
We normally ask for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: snews: and nntp:. Since most operating systems in 2024 don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. Of course, all bets are off if a user runs such a program to begin with, but in some situations (looking at you, MacOS!) just downloading/unpacking could already result in registration as a protocol handler without the user actually executing anything. |
||
|---|---|---|
| .. | ||
| extensions | ||
| channel-prefs.js | ||
| pagethemes.rdf | ||
| palemoon.js | ||
| prefs.js | ||