RequestPolicy is a Firefox extension that gives you control over cross-site requests. --- Be sure to look at the dev-1.0 branch as that's where all of the interesting work is happening. See also: https://www.requestpolicy.com/1.0.html
Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.
It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.
I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.
It's possible to bypass the whitelist entirely by referencing a resource using the jar URI scheme:
Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.
It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.
I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.