1
0
Fork 0

Merge commit 'bd1a0c28ddd2fc1f170151f8f9e4baab8be0d21e'

# Conflicts:
#	prefsCleaner.sh
This commit is contained in:
Michel 2023-01-06 10:34:21 +01:00
commit 35e6640731
5 changed files with 115 additions and 57 deletions

View File

@ -3,7 +3,7 @@ TITLE prefs.js cleaner
REM ### prefs.js cleaner for Windows
REM ## author: @claustromaniac
REM ## version: 2.4
REM ## version: 2.5
CD /D "%~dp0"
@ -13,7 +13,7 @@ ECHO:
ECHO ########################################
ECHO #### prefs.js cleaner for Windows ####
ECHO #### by claustromaniac ####
ECHO #### v2.4 ####
ECHO #### v2.5 ####
ECHO ########################################
ECHO:
CALL :message "This script should be run from your Firefox profile directory."
@ -30,9 +30,12 @@ IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory.
IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30)
CALL :strlenCheck
CALL :FFcheck
CALL :message "Backing up prefs.js..."
SET "_time=%time: =0%"
COPY /B /V /Y prefs.js "prefs-backup-%date:/=-%_%_time::=.%.js"
FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET ldt=%%j
SET ldt=%ldt:~0,8%_%ldt:~8,6%
COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js"
CALL :message "Cleaning prefs.js..."
CALL :cleanup
CALL :message "All done!"

View File

@ -2,33 +2,54 @@
## prefs.js cleaner for Linux/Mac
## author: @claustromaniac
## version: 1.5
## version: 1.6
## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh
currdir=$(pwd)
## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() )
readonly CURRDIR=$(pwd)
## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed)
#sfp=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null)
SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null)
## fallback for Macs without coreutils
#if [ -z "$sfp" ]; then sfp=${BASH_SOURCE[0]}; fi
[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]}
## change directory to the Firefox profile directory
#cd "$(dirname "${sfp}")"
AUTOUPDATE=false
QUICKSTART=false
## download method priority: curl -> wget
DOWNLOAD_METHOD=''
if command -v curl >/dev/null; then
DOWNLOAD_METHOD='curl --max-redirs 3 -so'
elif command -v wget >/dev/null; then
DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O'
else
AUTOUPDATE=false
echo -e "No curl or wget detected.\nAutomatic self-update disabled!"
fi
fQuit() {
## change directory back to the original working directory
cd "${currdir}"
cd "${CURRDIR}"
[ "$1" -eq 0 ] && echo -e "\n$2" || echo -e "\n$2" >&2
exit $1
}
fUsage() {
echo -e "\nUsage: $0 [-s]"
echo -e "\nUsage: $0 [-ds]"
echo -e "
Optional Arguments:
-s Start immediately"
-s Start immediately
-d Don't auto-update prefsCleaner.sh"
}
download_file() { # expects URL as argument ($1)
declare -r tf=$(mktemp)
$DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error
}
fFF_check() {
@ -40,6 +61,24 @@ fFF_check() {
done
}
## returns the version number of a prefsCleaner.sh file
get_prefsCleaner_version() {
echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")"
}
## updates the prefsCleaner.sh file based on the latest public version
update_prefsCleaner() {
declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/prefsCleaner.sh')"
[ -z "$tmpfile" ] && echo -e "Error! Could not download prefsCleaner.sh" && return 1 # check if download failed
[[ $(get_prefsCleaner_version "$SCRIPT_FILE") == $(get_prefsCleaner_version "$tmpfile") ]] && return 0
mv "$tmpfile" "$SCRIPT_FILE"
chmod u+x "$SCRIPT_FILE"
"$SCRIPT_FILE" "$@" -d
exit 0
}
fClean() {
# the magic happens here
prefs="@@"
@ -78,18 +117,37 @@ fStart() {
fQuit 0 "All done!"
}
while getopts "sd" opt; do
case $opt in
s)
QUICKSTART=true
;;
d)
AUTOUPDATE=false
;;
esac
done
## change directory to the Firefox profile directory
#cd "$(dirname "${SCRIPT_FILE}")"
[ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@"
echo -e "\n\n"
echo " ╔══════════════════════════╗"
echo " ║ prefs.js cleaner ║"
echo " ║ by claustromaniac ║"
echo " ║ v1.5 ║"
echo " ║ v1.6 ║"
echo " ╚══════════════════════════╝"
echo -e "\nThis script should be run from your Firefox profile directory.\n"
echo "It will remove any entries from prefs.js that also exist in user.js."
echo "This will allow inactive preferences to be reset to their default values."
echo -e "\nThis Firefox profile shouldn't be in use during the process.\n"
[ "$1" == '-s' ] && fStart
[ "$QUICKSTART" = true ] && fStart
echo -e "\nIn order to proceed, select a command below by entering its corresponding number.\n"
select option in Start Help Exit; do
case $option in
@ -113,3 +171,5 @@ select option in Start Help Exit; do
;;
esac
done
fQuit 0

View File

@ -3,7 +3,7 @@
- removed from the arkenfox user.js
- deprecated by Mozilla but listed in the arkenfox user.js in the past
Last updated: 4-November-2022
Last updated: 5-December-2022
Instructions:
- [optional] close Firefox and backup your profile
@ -238,13 +238,18 @@
/* REMOVED */
/* 103+ */
'beacon.enabled',
'browser.newtab.preload',
'browser.newtabpage.activity-stream.feeds.discoverystreamfeed',
'browser.newtabpage.activity-stream.feeds.snippets',
'browser.region.network.url',
'browser.region.update.enabled',
'browser.search.region',
'browser.ssl_override_behavior',
'browser.tabs.warnOnClose',
'devtools.chrome.enabled',
'dom.disable_beforeunload',
'dom.disable_open_during_load',
'dom.netinfo.enabled',
'dom.vr.enabled',
'extensions.formautofill.addresses.supported',
@ -252,6 +257,7 @@
'extensions.formautofill.creditCards.available',
'extensions.formautofill.creditCards.supported',
'network.http.altsvc.oe',
'security.tls.version.enable-deprecated',
/* 92-102 */
'browser.urlbar.trimURLs',
'dom.caches.enabled',

View File

@ -3,10 +3,10 @@ TITLE arkenfox user.js updater
REM ## arkenfox user.js updater for Windows
REM ## author: @claustromaniac
REM ## version: 4.16
REM ## version: 4.18
REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows
SET v=4.15
SET v=4.18
VERIFY ON
CD /D "%~dp0"
@ -177,8 +177,9 @@ IF EXIST user.js.new (
IF DEFINED _singlebackup (
MOVE /Y user.js user.js.bak >nul
) ELSE (
SET "_time=!time: =0!"
MOVE /Y user.js "user-backup-!date:/=-!_!_time::=.!.js" >nul
FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET ldt=%%j
SET ldt=!ldt:~0,8!_!ldt:~8,6!
MOVE /Y user.js "user-backup-!ldt!.js" >nul
)
REN user.js.new user.js
CALL :message "Update complete."

62
user.js
View File

@ -1,7 +1,7 @@
/******
* name: arkenfox user.js
* date: 6 November 2022
* version: 106
* date: 21 December 2022
* version: 108
* url: https://github.com/arkenfox/user.js
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
@ -110,13 +110,6 @@ user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
user_pref("geo.provider.use_corelocation", false); // [MAC]
user_pref("geo.provider.use_gpsd", false); // [LINUX]
user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX]
/* 0203: disable region updates
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
user_pref("browser.region.network.url", ""); // [FF78+]
user_pref("browser.region.update.enabled", false); // [FF79+]
/* 0204: set search region
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (0203) ***/
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
/* 0210: set preferred language for displaying pages
* [SETTING] General>Language and Appearance>Language>Choose your preferred language...
* [TEST] https://addons.mozilla.org/about ***/
@ -491,8 +484,8 @@ user_pref("security.remote_settings.crlite_filters.enabled", true);
user_pref("security.pki.crlite_mode", 2);
/** MIXED CONTENT ***/
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
user_pref("security.mixed_content.block_display_content", true);
/* 1241: disable insecure passive content (such as images) on https pages ***/
// user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
/* 1244: enable HTTPS-Only mode in all windows [FF76+]
* When the top-level is HTTPS, insecure subresources are also upgraded (silent fail)
* [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site")
@ -603,10 +596,7 @@ user_pref("media.eme.enabled", false);
user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
/* 2402: prevent scripts from moving and resizing open windows ***/
user_pref("dom.disable_window_move_resize", true);
/* 2403: block popup windows
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
user_pref("dom.disable_open_during_load", true);
/* 2404: limit events that can cause a popup [SETUP-WEB] ***/
/* 2404: limit events that can cause a pop-up [SETUP-WEB] ***/
user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
/*** [SECTION 2600]: MISCELLANEOUS ***/
@ -614,9 +604,6 @@ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curta
/* 2601: prevent accessibility services from accessing your browser [RESTART]
* [1] https://support.mozilla.org/kb/accessibility-services ***/
user_pref("accessibility.force_disabled", 1);
/* 2602: disable sending additional analytics to web servers
* [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/
user_pref("beacon.enabled", false);
/* 2603: remove temp files opened with an external application
* [1] https://bugzilla.mozilla.org/302433 ***/
user_pref("browser.helperApps.deleteTempFileOnExit", true);
@ -624,7 +611,7 @@ user_pref("browser.helperApps.deleteTempFileOnExit", true);
user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
user_pref("browser.uitour.enabled", false);
user_pref("browser.uitour.url", "");
// user_pref("browser.uitour.url", ""); // Defense-in-depth
/* 2608: reset remote debugging to disabled
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
@ -648,16 +635,16 @@ user_pref("webchannel.allowObject.urlWhitelist", "");
* [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox
* [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
user_pref("network.IDN_show_punycode", true);
/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME]
/* 2620: enforce PDFJS, disable PDFJS scripting
* This setting controls if the option "Display in Firefox" is available in the setting below
* and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
* PROS: pdfjs is lightweight, open source, and more secure/vetted than most
* Exploits are rare (one serious case in seven years), treated seriously and patched quickly.
* [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1]
* It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
* It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
* CONS: You may prefer a different pdf reader for security reasons
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
* [NOTE] JS can still force a pdf to open in-browser by bundling its own code
* [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons
* [SETTING] General>Applications>Portable Document Format (PDF)
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
user_pref("pdfjs.enableScripting", false); // [FF86+]
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
@ -717,8 +704,8 @@ user_pref("browser.contentblocking.category", "strict");
/* 2710: enable state partitioning of service workers [FF96+] ***/
user_pref("privacy.partition.serviceWorkers", true); // [DEFAULT: true FF105+]
/* 2720: enable APS (Always Partitioning Storage) ***/
user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [FF104+]
user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [FF105+]
user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [FF104+] [DEFAULT: true FF109+]
user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [FF105+] [DEFAULT: false FF109+]
/*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/
user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!");
@ -809,7 +796,6 @@ user_pref("privacy.sanitize.timeSpan", 0);
1382545 - reduce fingerprinting in Animation API
1354633 - limit MediaError.message to a whitelist
FF58+
967895 - spoof canvas and enable site permission prompt (FF58)
1372073 - spoof/block fingerprinting in MediaDevices API (FF59)
Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone"
Block: suppresses the ondevicechange event
@ -925,7 +911,7 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow
/* 5005: disable intermediate certificate caching [FF41+] [RESTART]
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
* Saved logins and passwords are not available. Reset the pref and restart to return them ***/
// user_pref("security.nocertdb", true); // [HIDDEN PREF in FF101 or lower]
// user_pref("security.nocertdb", true);
/* 5006: disable favicons in history and bookmarks
* [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your
* actual history (and bookmarks) already do. Your history is more detailed, so
@ -1038,21 +1024,24 @@ user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false]
* In FF96+ these are listed in about:compat
* [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/
user_pref("extensions.webcompat.enable_shims", true); // [DEFAULT: true]
/* 6010: enforce/reset TLS 1.0/1.1 downgrades to session only
* [NOTE] In FF97+ the TLS 1.0/1.1 downgrade UX was removed
/* 6010: enforce no TLS 1.0/1.1 downgrades
* [TEST] https://tls-v1-1.badssl.com:1010/ ***/
user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false]
/* 6011: enforce disabling of Web Compatibility Reporter [FF56+]
* Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla
* [WHY] To prevent wasting Mozilla's time with a custom setup ***/
user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false]
/* 6050: prefsCleaner: reset items removed from arkenfox FF102+ ***/
/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF102+ ***/
// user_pref("beacon.enabled", "");
// user_pref("browser.newtab.preload", "");
// user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", "");
// user_pref("browser.newtabpage.activity-stream.feeds.snippets", "");
// user_pref("browser.region.network.url", "");
// user_pref("browser.region.update.enabled", "")
// user_pref("browser.ssl_override_behavior", "");
// user_pref("devtools.chrome.enabled", "");
// user_pref("dom.disable_beforeunload", "");
// user_pref("dom.disable_open_during_load", "");
// user_pref("extensions.formautofill.available", "");
// user_pref("extensions.formautofill.addresses.supported", "");
// user_pref("extensions.formautofill.creditCards.available", "");
@ -1082,8 +1071,8 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies
/* 7003: disable non-modern cipher suites [1]
* [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks
* [1] https://browserleaks.com/ssl ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF109+]
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF109+]
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
// user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS
@ -1097,7 +1086,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies
/* 7005: disable SSL session IDs [FF36+]
* [WHY] Passive fingerprinting and perf costs. These are session-only
* and isolated with network partitioning (FF85+) and/or containers ***/
// user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF in FF101 or lower]
// user_pref("security.ssl.disable_session_identifiers", true);
/* 7006: onions
* [WHY] Firefox doesn't support hidden services. Use Tor Browser ***/
// user_pref("dom.securecontext.allowlist_onions", true); // [FF97+] 1382359/1744006
@ -1146,8 +1135,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies
// user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true]
// user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true]
/* 7017: disable service workers
* [WHY] Already isolated (FF96+) with TCP (2701) behind a pref (2710)
* or blocked with TCP in 3rd parties (FF95 or lower) ***/
* [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/
// user_pref("dom.serviceWorkers.enabled", false);
/* 7018: disable Web Notifications
* [WHY] Web Notifications are behind a prompt (7002)