Opened on 07/24/2015 at 03:22:45 PM
Closed on 08/14/2015 at 06:09:48 PM
#2817 closed defect (duplicate)
unauthorized addition of another filter extension
| Reported by: | egoistlike | Assignee: | |
|---|---|---|---|
| Priority: | Unknown | Milestone: | |
| Module: | Adblock-Plus-for-Firefox | Keywords: | |
| Cc: | greiner, trev | Blocked By: | |
| Blocking: | Platform: | Firefox | |
| Ready: | no | Confidential: | no |
| Tester: | Unknown | Verified working: | no |
| Review URL(s): | |||
Description
unauthorized addition of another filter extension.
without notice Adblock Plus
Attachments (1)
Change History (6)
Changed on 07/24/2015 at 03:23:30 PM by egoistlike
comment:1 Changed on 07/25/2015 at 02:52:41 PM by Lain_13
I think the main point of this bug-report is that ABP does not inform the user about changes made by the other extension. I think it at least have to show a warning when third-party extension attempts to add new filters to let the user allow or deny access for that extension.
comment:2 Changed on 07/27/2015 at 04:26:18 PM by greiner
- Cc greiner trev added
- Component changed from Unknown to Adblock-Plus-for-Firefox
At least for IAdblockPlus we could implement some similar dialog to the one we have for abp:subscribe links but I'd like to hear Wladimir's opinion on that first.
Generally, if you install an extension I don't think there's much we can do to prevent abuse.
comment:3 Changed on 07/28/2015 at 11:00:22 AM by trev
Yes, that's exactly the point - we cannot prevent abuse, and truly malicious extensions generally aren't bound to our IAdblockPlus API, they can always use internal APIs. So the idea was always that it's up to that other extension to inform the user appropriately.
Note that IAdblockPlus can also be used to add/remove custom filters - that functionality is currently being used by Element Hiding Helper. Confirmation is unnecessary in this case - the user explicitly asked the filter to be added. So while adding this confirmation has been discussed a number of times already, I'm still undecided as to whether it is a good idea.
Btw, the s3translator subscription is being added by S3.Google Translator, going to about:config and setting extensions.s3gt.temporary_deactivate.adblockplus preference to false will disable this behavior.
comment:4 Changed on 08/11/2015 at 10:55:40 AM by trev
Author of S3.Google Translator is going to remove this functionality. He doesn't know which filter list cause the issue with Google's translation API but it's likely a false positive that has been fixed already. If the issue comes back we'll need to make sure that the filter list responsible gets fixed.
Screenshots