Opened 4 years ago

Closed 4 years ago

#2817 closed defect (duplicate)

unauthorized addition of another filter extension

Reported by: egoistlike Assignee:
Priority: Unknown Milestone:
Module: Adblock-Plus-for-Firefox Keywords:
Cc: greiner, trev Blocked By:
Blocking: Platform: Firefox
Ready: no Confidential: no
Tester: Unknown Verified working: no
Review URL(s):

Description

unauthorized addition of another filter extension.
without notice Adblock Plus
http://savepic.net/7056643.png

Attachments (1)

7056643.png (20.7 KB) - added by egoistlike 4 years ago.
Screenshots

Download all attachments as: .zip

Change History (6)

Changed 4 years ago by egoistlike

Screenshots

comment:1 Changed 4 years ago by Lain_13

I think the main point of this bug-report is that ABP does not inform the user about changes made by the other extension. I think it at least have to show a warning when third-party extension attempts to add new filters to let the user allow or deny access for that extension.

comment:2 Changed 4 years ago by greiner

  • Cc greiner trev added
  • Component changed from Unknown to Adblock-Plus-for-Firefox

At least for IAdblockPlus we could implement some similar dialog to the one we have for abp:subscribe links but I'd like to hear Wladimir's opinion on that first.

Generally, if you install an extension I don't think there's much we can do to prevent abuse.

comment:3 Changed 4 years ago by trev

Yes, that's exactly the point - we cannot prevent abuse, and truly malicious extensions generally aren't bound to our IAdblockPlus API, they can always use internal APIs. So the idea was always that it's up to that other extension to inform the user appropriately.

Note that IAdblockPlus can also be used to add/remove custom filters - that functionality is currently being used by Element Hiding Helper. Confirmation is unnecessary in this case - the user explicitly asked the filter to be added. So while adding this confirmation has been discussed a number of times already, I'm still undecided as to whether it is a good idea.

Btw, the s3translator subscription is being added by S3.Google Translator, going to about:config and setting extensions.s3gt.temporary_deactivate.adblockplus preference to false will disable this behavior.

comment:4 Changed 4 years ago by trev

Author of S3.Google Translator is going to remove this functionality. He doesn't know which filter list cause the issue with Google's translation API but it's likely a false positive that has been fixed already. If the issue comes back we'll need to make sure that the filter list responsible gets fixed.

comment:5 Changed 4 years ago by trev

  • Resolution set to duplicate
  • Status changed from new to closed

This is a duplicate of #2137 actually.

Note: See TracTickets for help on using tickets.