From da9f912862172f49454b5be977e0c7d133c03b25 Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Fri, 23 Apr 2021 14:25:54 +0000 Subject: [PATCH] 2620: disable pdfjs scripting, v88 final --- user.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/user.js b/user.js index cc11451..c029dd5 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: arkenfox user.js -* date: 06 April 2021 -* version 88-alpha +* date: 23 April 2021 +* version 88 * url: https://github.com/arkenfox/user.js * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt @@ -1163,17 +1163,18 @@ user_pref("webchannel.allowObject.urlWhitelist", ""); * [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/ * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ user_pref("network.IDN_show_punycode", true); -/* 2620: enforce Firefox's built-in PDF reader [SETUP-CHROME] +/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME] * This setting controls if the option "Display in Firefox" is available in the setting below * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") * PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most) - * Exploits are rare (1 serious case in 4 yrs), treated seriously and patched quickly. + * Exploits are rare (one serious case in seven years), treated seriously and patched quickly. * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. * CONS: You may prefer a different pdf reader for security reasons * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare) * [SETTING] General>Applications>Portable Document Format (PDF) ***/ user_pref("pdfjs.disabled", false); // [DEFAULT: false] +user_pref("pdfjs.enableScripting", false); // [FF86+] /* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ user_pref("network.protocol-handler.external.ms-windows-store", false); /* 2622: enforce no system colors; they can be fingerprinted