Sakurai/pdf.js
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Firefox] Disable the ability to change preferences directly from the viewer

Browse Source 
Please note that we've never had any functionality in the viewer itself that *set* preferences, and we've thus only ever read them.
For the GENERIC viewer it obviously makes sense for the user to be able to modify preferences, e.g. via the console, but that doesn't really apply to the *built-in* Firefox PDF Viewer since preferences are already accessible via `about:config` there. Hence it does seems somewhat strange to expose, a limited part of, the Firefox preference system in this way when we're not even using it.

Note that the unused preference setting-code also include a fair amount of *additional* validation on the platform-side, such as limiting any possible preference changes to the `pdfjs.`-branch and also an explicit white-list of preference names[1], to make sure that this is safe; please see:
 - https://searchfox.org/mozilla-central/rev/4e8f62a231e71dc53eb50b6d74afca21d6b254e9/toolkit/components/pdfjs/content/PdfStreamConverter.sys.mjs#458-495
 - https://searchfox.org/mozilla-central/rev/4e8f62a231e71dc53eb50b6d74afca21d6b254e9/toolkit/modules/AsyncPrefs.sys.mjs#21-48

Assuming that this patch lands, I'll follow-up with a mozilla-central patch to remove the code mentioned above.

---
[1] This hard-coded list contains preferences that no longer exist, and also at least one (fairly obvious) typo.
This commit is contained in:
Jonas Jenwald 2023-06-21 18:28:35 +02:00
parent 7742d6e4a6
commit 1f9d1f3696
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
web/firefoxcom.js
View File

@ -174,10 +174,6 @@ class DownloadManager {
}
class FirefoxPreferences extends BasePreferences {
async _writeToStorage(prefObj) {
return FirefoxCom.requestAsync("setPreferences", prefObj);
}
async _readFromStorage(prefObj) {
const prefStr = await FirefoxCom.requestAsync("getPreferences", prefObj);
return JSON.parse(prefStr);

6
web/preferences.js
View File

@ -83,6 +83,9 @@ class BasePreferences {
* have been reset.
*/
async reset() {
if (typeof PDFJSDev !== "undefined" && PDFJSDev.test("MOZCENTRAL")) {
throw new Error("Please use `about:config` to change preferences.");
}
await this.#initializedPromise;
const prefs = this.#prefs;
@ -102,6 +105,9 @@ class BasePreferences {
* provided that the preference exists and the types match.
*/
async set(name, value) {
if (typeof PDFJSDev !== "undefined" && PDFJSDev.test("MOZCENTRAL")) {
throw new Error("Please use `about:config` to change preferences.");
}
await this.#initializedPromise;
const defaultValue = this.#defaults[name],
prefs = this.#prefs;