From ac52886ea8c54f2bee386456459c1d34c09cf265 Mon Sep 17 00:00:00 2001 From: Thorin-Oakenpants Date: Mon, 26 Oct 2020 23:37:49 +1300 Subject: [PATCH] 2422 WASM, add reason for disabling, fixes #1037 (#1054) --- user.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 1eabb133..0b497392 100644 --- a/user.js +++ b/user.js @@ -1047,8 +1047,14 @@ user_pref("javascript.options.asmjs", false); // user_pref("javascript.options.ion", false); // user_pref("javascript.options.baselinejit", false); // user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] -/* 2422: disable WebAssembly [FF52+] [SETUP-PERF] - * [1] https://developer.mozilla.org/docs/WebAssembly ***/ +/* 2422: disable WebAssembly [FF52+] + * Vulnerabilities have increasingly been found, including those known and fixed + * in native programs years ago [2]. WASM has powerful low-level access, making + * certain attacks (brute-force) and vulnerabilities more possible + * [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3] + * [1] https://developer.mozilla.org/docs/WebAssembly + * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly + * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ user_pref("javascript.options.wasm", false); /* 2429: enable (limited but sufficient) window.opener protection [FF65+] * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/