Waterfox: URL automatically loading dropped text because of "security reasons" seriously impairs locationbar functionality.

[mzso]

Hi!

I thought I'd file an issue for this. This seriously screws up my usage of the browser, since I use dropped text for keyword searches and such all the time. On bugzilla it was claimed that this was made for "security reasons", probably that's why it got uplifted to Waterfox.

At least a setting to disable this would be nice. I fail to see any real life risk to being able to drop and edit text.
Unlike this new behavior which can instantly resolve/load/execute malicious dropped content...

[grahamperrin]

Related:

• https://hg.mozilla.org/releases/mozilla-beta/rev/aa132747394e61e607ce2e3bea248c1e66011aea (2017-11-09)
• CVE - CVE-2018-5111 (2018-01-03)
• MFSA 2018-02 – Security vulnerabilities fixed in Firefox 58 — Mozilla (2018-01-23)
• https://www.reddit.com/r/waterfox/comments/7uvihq/-/dw814yj/?context=1

From https://www.mozilla.org/security/advisories/mfsa2018-02/#CVE-2018-5111:

CVE-2018-5111: URL spoofing in addressbar through drag and drop

…
When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded. This allows for phishing attacks where a malicious page can spoof the identify of another site.

From Mozilla bug 1449881 - Text dropped in the urlbar is instanly resolved/searched, preventing the user from modifying it (RESOLVED INVALID):

… IIRC it was bug 1321619, it's still closed for security reasons.

[mzso]

@grahamperrin
So they "fixed" it by breaking the drag&drop feature...

[mzso]

This is terribly annoying. I even tried "Simplify Awesome Bar" to work around much of the issue. But stuff from text/input fields sometimes.

Does anyone know about addon writing: I wonder how hard would it be to steal the "stuff dropped action" from the browser to prevent anything other than the drop happening.

[mzso]

Doesn't anyone know of an addon that manipulates the functioning of the locationbar that might be used as a workaround, for this annoying "security fix"?

[PandaCodex]

@mzso You could download the source code, revert the patch then compile a personal build of waterfox

First you need to setup the build environment (Visual studios, direct x, github, rust or other tools required) see https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions for more information on this for windows https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites

[mzso]

@PandaCodex commented on 2018. ápr. 11. 15:43 CEST:

@mzso You could download the source code, revert the patch then compile a personal build of waterfox

First you need to setup the build environment (Visual studios, direct x, github, rust or other tools required) see https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions for more information on this for windows https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites

If I could just do that I would, instead of just commenting about it.

[grahamperrin]

… use dropped text for keyword searches and such …

Doesn't anyone know of an addon that manipulates the functioning of the locationbar …

No (sorry) but since you described your use case in Reddit, I _have_ begun using the search field for drag-and-drop searches: https://photos.app.goo.gl/jDTm6guVRbJLqO4U2

[MrAlex94]

@mzso, I'll wrap this around a pref if you'd like?

[mzso]

@MrAlex94 commented on 2018. ápr. 12. 21:46 CEST:

@mzso, I'll wrap this around a pref if you'd like?

That'd be much appreciated.

[MrAlex94]

Added it to the release check list :-)

On Thu, 12 Apr 2018 at 20:55, mzso [e-mail] wrote:

@MrAlex94 https://github.com/MrAlex94 commented on 2018. ápr. 12.
21:46 CEST
https://github.com/MrAlex94/Waterfox/issues/499#issuecomment-380923027:

@mzso https://github.com/mzso, I'll wrap this around a pref if you'd
like?

That'd be much appreciated.

—
You are receiving this because you commented.

Reply to this email directly, view it on GitHub
https://github.com/MrAlex94/Waterfox/issues/499#issuecomment-380925539,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AEgoWGSeoSBoXCoXBl819-ARJgxrbZWXks5tn7EzgaJpZM4TAsab
.

[mzso]

@MrAlex94 commented on 2018. ápr. 16. 23:57 CEST:

Added it to the release check list :-)

Great!
By the way. Can you make that checklist public? I'd be interested in keeping an eye on it to know what to expect.

[MrAlex94]

Added in https://github.com/MrAlex94/Waterfox/commit/137b2ab3e7e3b9ddce51c25d639bd0417bdc0a72, can be toggled with browser.urlbar.dragDropLoad being set to true.

After the next update, please re-open if you have issues.

[mzso]

@MrAlex94 commented on 2018. ápr. 25. 18:20 CEST:

Added in 137b2ab, can be toggled with browser.urlbar.dragDropLoad being set to true.

After the next update, please re-open if you have issues.

Great! Thanks!

[mzso]

@MrAlex94 commented on 2018. ápr. 25. 18:20 CEST:

Added in 137b2ab, can be toggled with browser.urlbar.dragDropLoad being set to true.

After the next update, please re-open if you have issues.

By the way. Does this restore the old behavior as it was? Because that was glitchy, and I can think of improvements.
It tried to load anything if it started with a seqeuence of alphanumeric characters with a ":" at the end, regardless whether it was a valid protocol or not.

One simple improvement would be to not load anything at all, if this new setting for loading is set to false.

Or it could have three states for this.