Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/**
* Denylists for the two messaging-system allowlists that can be extended
* off-train through the `ms-action-allowlists` Remote Settings collection (see
* MessagingSystemAllowlists.sys.mjs).
*
* Publishing a record to that collection grants a capability to every message
* delivered through Nimbus without the code review that gates the in-tree
* baseline lists. Entries here can never be granted that way - matching records
* are discarded when the collection is read.
*
* This list only ever filters Remote Settings records. Consumers union the
* baseline with what survives that filter, so an entry here has no effect if it
* is also in the baseline, and it can never revoke a baseline entry. See
* MessagingSystemAllowlists.sys.mjs for how the three lists resolve.
*
* To grant something listed here, add it to the baseline allowlist:
* ALLOWED_ACTION_MESSAGE_ACTIONS in ASRouter.sys.mjs for actions, allowedPrefs
* in SpecialMessageActions.setPref for prefs. Delete its entry here in the same
* patch, since the baseline wins and the entry would no longer block anything.
*
* Removing an entry from this file widens what can be granted off-train and
* should get security review.
*
* Deliberately absent, and grantable off-train by design: SET_PREF, bounded by
* the pref lists below rather than by this one; the set-default actions; and the
* pinning actions. These are the capabilities the collection exists to
* experiment with.
*
*/
/**
* Special message action types that are not allowed for "action_only" template
* messages through Remote Settings. These messages have no UI and fire as soon
* as their trigger matches, so anything listed here would run without the user
* seeing or agreeing to anything.
*/
export const BLOCKED_ACTION_ONLY_ACTIONS = new Set([
// Installs code that is not part of the shipped browser.
"INSTALL_ADDON_FROM_URL",
// Renders message-supplied content whose buttons dispatch actions that never
// pass through the action_only check.
"SHOW_SPOTLIGHT",
// Weakens a privacy or security posture, or silences the UI that would tell
// the user about it. These also write prefs directly, bypassing SET_PREF's
// allowlist.
"DISABLE_DOH",
"ACCEPT_DOH",
"DISABLE_STP_DOORHANGERS",
"DECLINE_DEFAULT_PDF_HANDLER",
// Writes the homepage and newtab layout prefs through Services.prefs, so it
// reaches prefs that SET_PREF's own allowlist would not grant.
"CONFIGURE_HOMEPAGE",
// Acts on the user's identity and starts a sign-in flow, enrolls them in a
// service, or creates a profile.
"SHOW_FIREFOX_ACCOUNTS",
"FXA_SIGNIN_FLOW",
"FXA_AIWINDOW_SIGNIN_FLOW",
"IPPROTECTION_ENROLL",
"CREATE_NEW_SELECTABLE_PROFILE",
// Sends data off the device, or fabricates a record that the user consented
// to something.
"SUMMARIZE_PAGE",
"SUBMIT_ONBOARDING_OPT_OUT_PING",
"SET_TERMS_OF_USE_INTERACTED",
"GET_REFERRAL_CODE",
// Navigates the user or redirects their next search.
"OPEN_URL",
"SET_SEARCH_MODE",
// Suppresses or removes parts of the browser, including messages the user is
// meant to see, such as the terms of use notice.
"BLOCK_MESSAGE",
"DESTROY_UIWIDGET",
]);
/**
* Pref branches that must never become writable by SET_PREF through Remote
* Settings. Matched with startsWith, so an entry does not have to end at a dot.
*/
export const BLOCKED_SET_PREF_PREFIXES = [
// Add-on and application update integrity.
"app.update.",
"extensions.",
"xpinstall.",
// Transport, name resolution, and certificate and sandbox policy.
"network.proxy.",
"network.dns.",
"network.trr.",
"network.protocol-handler.",
"security.",
"dom.security.",
// Arbitrary code at startup, legacy privilege grants, and remote debugging.
"general.config.",
"capability.policy.",
"javascript.options.",
"devtools.debugger.remote-",
// Enterprise policy and phishing/malware protection.
"browser.policies.",
"browser.safebrowsing.",
// Blanket permission grants, e.g. permissions.default.camera.
"permissions.default.",
// Where the browser fetches configuration, experiments and messages from.
// Granting any of these would let a record widen its own delivery channel.
"services.settings.",
"services.sync.",
"app.normandy.",
"messaging-system.rsexperimentloader.",
"browser.newtabpage.activity-stream.asrouter.providers.",
// Where data is sent, and the account it is tied to.
"toolkit.telemetry.",
"identity.fxaccounts.",
// Stored credentials, data clearing, downloads and search configuration.
"signon.",
"privacy.sanitize.",
"privacy.clearOnShutdown",
"browser.download.",
"browser.search.",
];
/**
* Individual prefs that should not become writable by SET_PREF through Remote
* Settings. These are cases where neighbouring prefs in the same branch are
* legitimately grantable.
*/
export const BLOCKED_SET_PREFS = new Set([
"browser.contentblocking.category",
"datareporting.policy.dataSubmissionPolicyBypassNotification",
"pdfjs.enableScripting",
"privacy.resistFingerprinting",
"privacy.trackingprotection.enabled",
"privacy.trackingprotection.cryptomining.enabled",
"privacy.trackingprotection.fingerprinting.enabled",
"privacy.trackingprotection.socialtracking.enabled",
]);
export const MessagingSystemBlocklists = {
/**
* @param {string} type - A special message action type.
* @returns {boolean} Whether the action may never be granted to
* "action_only" messages through Remote Settings.
*/
isActionOnlyActionBlocked(type) {
return BLOCKED_ACTION_ONLY_ACTIONS.has(type);
},
/**
* @param {string} name - A pref name.
* @returns {boolean} Whether the pref may never be made SET_PREF writable
* through Remote Settings.
*/
isSetPrefBlocked(name) {
return (
BLOCKED_SET_PREFS.has(name) ||
BLOCKED_SET_PREF_PREFIXES.some(prefix => name.startsWith(prefix))
);
},
};