commit da9f912862172f49454b5be977e0c7d133c03b25
parent 9930cfbc077917497f54ad6d449b76432e97b697
Author: Thorin-Oakenpants <Thorin-Oakenpants@users.noreply.github.com>
Date: Fri, 23 Apr 2021 14:25:54 +0000
2620: disable pdfjs scripting, v88 final
Diffstat:
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/user.js b/user.js
@@ -1,7 +1,7 @@
/******
* name: arkenfox user.js
-* date: 06 April 2021
-* version 88-alpha
+* date: 23 April 2021
+* version 88
* url: https://github.com/arkenfox/user.js
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
@@ -1163,17 +1163,18 @@ user_pref("webchannel.allowObject.urlWhitelist", "");
* [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/
* [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
user_pref("network.IDN_show_punycode", true);
-/* 2620: enforce Firefox's built-in PDF reader [SETUP-CHROME]
+/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME]
* This setting controls if the option "Display in Firefox" is available in the setting below
* and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
* PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most)
- * Exploits are rare (1 serious case in 4 yrs), treated seriously and patched quickly.
+ * Exploits are rare (one serious case in seven years), treated seriously and patched quickly.
* It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
* It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
* CONS: You may prefer a different pdf reader for security reasons
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
+user_pref("pdfjs.enableScripting", false); // [FF86+]
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
user_pref("network.protocol-handler.external.ms-windows-store", false);
/* 2622: enforce no system colors; they can be fingerprinted
