feat: disable creation of window.ipfs attribute in Firefox #495
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lidel
force-pushed
the
feat/hide-window.ipfs
branch
from
7e3731b
to
fccc7d3
Compare
Injecting proxy into application/xml produced malformed XML and SVG files. This adds some sanity-checks and ensures injection happens only in HTML contexts. It also improves performance by avoiding unnecessary port creation.
This change enables Firefox users to disable creation of window.ipfs, solving fingerprinting issue raised in: #451 The key difference between tabs.executeScript and contentScripts API is that the latter provides guarantee to execute before anything else. Chrome does not provide contentScripts API and we need to statically load content_script via manifest. More info on the underlying issue: #368 #362 (comment)
MANIFEST_FIELD_INVALID "/content_scripts" should be array
lidel
force-pushed
the
feat/hide-window.ipfs
branch
from
fccc7d3
to
3c53eb5
Compare
lidel
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR enables Firefox users to disable creation of
window.ipfsattribute via Preferences screen, solving fingerprinting issue raised in #451.It requires webpack, so should be merged after #498
Background
Existing
tabs.executeScriptAPI withrunAt: 'document_start'flag was executing too late and page scripts were unable to detectwindow.ipfscorrectly. More info on the underlying issue: #368 #362 (comment)As a workaround that worked in both Chrome and Firefox, we were forced to always load content script via manifest definition. This meant no control over when it is loaded and no easy off switch. If
window.ipfswas disabled via Preferences, it was throwing an Error on access, but remained in the scope.Mozilla added
contentScriptsAPI in Firefox 59. The key difference betweentabs.executeScriptandcontentScriptsAPI is that the latter provides guarantee to execute before anything else on the page, passing our synchronous smoke test.Known Issues
Chrome does not provide
contentScriptsAPI so it will continue to statically loadcontent_scriptvia manifest. Hopefully with time, other browser vendors will adopt the new API.