commit c8f7cd3fec5d5845179fcf71ad46888f2d14c8b0
Author: Pier Angelo Vendrame <pierov(a)torproject.org>
Date: Thu Feb 17 09:53:48 2022 +0100
Bug 19850: Disable Plaintext HTTP Clearnet Connections
The HTTPS-Only mode of Firefox starts a background connection to verify
whether HTTP is available, if the HTTPS connection does not start
within a timeout.
This commit disables this feature in Safer and Safest modes.
---
modules/security-prefs.js | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/modules/security-prefs.js b/modules/security-prefs.js
index d02e0d94..c41458fa 100644
--- a/modules/security-prefs.js
+++ b/modules/security-prefs.js
@@ -19,16 +19,17 @@ let log = (level, msg) => logger.log(level, msg);
// bind NoScript settings to the extensions.torbutton.security_slider
// (see noscript-control.js).
const kSecuritySettings = {
- // Preference name : [0, 1-high 2-m 3-m 4-low]
- "javascript.options.ion" : [, false, false, false, true ],
- "javascript.options.baselinejit" : [, false, false, false, true ],
- "javascript.options.native_regexp" : [, false, false, false, true ],
- "mathml.disabled" : [, true, true, true, false],
- "gfx.font_rendering.graphite.enabled" : [, false, false, false, true ],
- "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ],
- "svg.disabled" : [, true, false, false, false],
- "javascript.options.asmjs" : [, false, false, false, true ],
- "javascript.options.wasm" : [, false, false, false, true ],
+ // Preference name : [0, 1-high 2-m 3-m 4-low]
+ "javascript.options.ion" : [, false, false, false, true ],
+ "javascript.options.baselinejit" : [, false, false, false, true ],
+ "javascript.options.native_regexp" : [, false, false, false, true ],
+ "mathml.disabled" : [, true, true, true, false],
+ "gfx.font_rendering.graphite.enabled" : [, false, false, false, true ],
+ "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ],
+ "svg.disabled" : [, true, false, false, false],
+ "javascript.options.asmjs" : [, false, false, false, true ],
+ "javascript.options.wasm" : [, false, false, false, true ],
+ "dom.security.https_only_mode_send_http_background_request" : [, false, false, false, true ],
};
// The Security Settings prefs in question.