mozilla

Revision 309561 of Bypassing Security Restrictions and Signing Code

  • Revision slug: Bypassing_Security_Restrictions_and_Signing_Code
  • Revision title: Bypassing Security Restrictions and Signing Code
  • Revision id: 309561
  • Created:
  • Creator: Hans.Hokke
  • Is current revision? No
  • Comment

Revision Content

{{ deprecated_header() }}

Early versions of Firefox allowed web sites to segregate principals using signed scripts, and request extra permissions for scopes within signed scripts using a function called enablePrivelege. These feature was not used much (aside from abuse), and its complexity made performance improvements difficult. Signed script segregation was removed in bug 726125, the enablePrivilege prompt was removed in bug 750859, and enablePrivilege itself was nerfed in bug 757046.

EnablePrivilege is disabled in Firefox 15 and will be removed in Firefox 17.

Sites that require additional permissions should now ask Firefox users to install an extension, which can interact with non-privileged pages if needed.

Revision Source

<p>{{ deprecated_header() }}</p>
<p>Early versions of Firefox allowed web sites to segregate <a href="https://developer.mozilla.org/en-US/docs/Security_check_basics" title="https://developer.mozilla.org/en-US/docs/Security_check_basics">principals</a> using signed scripts, and request extra permissions for scopes within signed scripts using a function called <code>enablePrivelege</code>. These feature was not used much (aside from abuse), and its complexity made performance improvements difficult. Signed script segregation was removed in <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=726125" title="https://bugzilla.mozilla.org/show_bug.cgi?id=726125">bug 726125</a>, the <code>enablePrivilege</code> prompt was removed in <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=750859" title="https://bugzilla.mozilla.org/show_bug.cgi?id=750859">bug 750859</a>, and <code>enablePrivilege</code> itself was nerfed in <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=757046" title="https://bugzilla.mozilla.org/show_bug.cgi?id=757046">bug 757046</a>.</p>
<p>EnablePrivilege is disabled in Firefox 15 and will be removed in Firefox 17.</p>
<p>Sites that require additional permissions should now ask Firefox users to install an <a href="https://developer.mozilla.org/en-US/docs/Extensions" title="https://developer.mozilla.org/en-US/docs/Extensions">extension</a>, which can <a href="https://developer.mozilla.org/en-US/docs/Code_snippets/Interaction_between_privileged_and_non-privileged_pages" title="https://developer.mozilla.org/en-US/docs/Code_snippets/Interaction_between_privileged_and_non-privileged_pages">interact with non-privileged pages</a> if needed.</p>
Revert to this revision