search

mozilla / policy-templates

Policy Templates for Firefox
Mozilla Public License 2.0
1.13k stars 404 forks source link

SearchEngines | Remove - Removing all default SearchEngines #706

Open eMPai-git opened 3 years ago

eMPai-git commented 3 years ago

Problem

I want to remove all preinstalled and add a custom search engine list. I do add a slightly different Google search engine URL after removing the default one (to get rid of the default client=firefox addition in the URL). All worked fine in ESR 68. But since ESR 78 the default Google engine isn't removed any more.

    "SearchEngines": {
      "Add": [
        {
          "Description": "Google Search",
          "IconURL": "https://www.google.com/favicon.ico",
          "Method": "GET",
          "Name": "Google (de)",
          "URLTemplate": "https://www.google.de/search?q={searchTerms}&region=de-DE"
        }
      ],
      "Remove": [
        "Google",
        "Bing",
        "Amazon.de",
        "DuckDuckGo",
        "eBay",
        "Ecosia",
        "LEO Eng-Deu",
        "Wikipedia (de)"
      ]
    },

System

mkaply commented 3 years ago

Can you try changing the default search to your engine using SearchEngines | Default and see if that helps?

eMPai-git commented 3 years ago

SearchEngines | Default is set to a different search engine.

Here is my setup (Note: I removed Description, IconURL and Method from the entries for better overview):

"SearchEngines": {
      "Add": [
        {
          "Name": "Qwant",
          "SuggestURLTemplate": "https://api.qwant.com/api/suggest/?q={searchTerms}",
          "URLTemplate": "https://www.qwant.com/?q={searchTerms}"
        },
        {
          "Name": "Qwant Lite",
          "SuggestURLTemplate": "https://api.qwant.com/api/suggest/?q={searchTerms}",
          "URLTemplate": "https://lite.qwant.com/?q={searchTerms}"
        },
        {
          "Name": "DuckDuckGo (de)",
          "SuggestURLTemplate": "https://duckduckgo.com/ac/?q={searchTerms}",
          "URLTemplate": "https://duckduckgo.com/?q={searchTerms}"
        },
        {
          "Name": "DuckDuckGo Lite",
          "SuggestURLTemplate": "https://duckduckgo.com/ac/?q={searchTerms}",
          "URLTemplate": "https://duckduckgo.com/html?q={searchTerms}"
        },
        {
          "Name": "dict.cc",
          "URLTemplate": "https://www.dict.cc/?s={searchTerms}"
        },
        {
          "Name": "DeepL",
          "URLTemplate": "https://www.deepl.com/translator#../de/{searchTerms}"
        },
        {
          "Name": "Wikipedia",
          "SuggestURLTemplate": "https://de.wikipedia.org/w/api.php?action=opensearch&search={searchTerms}",
          "URLTemplate": "https://de.wikipedia.org/wiki/Spezial:Suche?search={searchTerms}"
        },
        {
          "Name": "Google (de)",
          "URLTemplate": "https://www.google.de/search?q={searchTerms}&region=de-DE"
        }
      ],
      "Default": "DuckDuckGo (de)",
      "PreventInstalls": true,
      "Remove": [
        "Google",
        "Bing",
        "Amazon.de",
        "DuckDuckGo",
        "eBay",
        "Ecosia",
        "LEO Eng-Deu",
        "Wikipedia (de)"
      ]
    },

I'm getting the impression this is somehow related to the other issue #705 I opened. Changing the langpack ID or blocking all of them seems to influence the behavior.

EDIT:

Couldn't find anything suspicious in the langpack-de@firefox-esr.mozilla.org.xpi extension.

mkaply commented 3 years ago

Are you still seeing this after fixing the other langpack issues?

I definitely don't see it by default.

eMPai-git commented 3 years ago

Did some more testing.

Debian 10.9 Firefox 78.9.0esr

1. Just remove all default SearchEngines

Removing all SearchEngines without adding one is not possible for me, regardless of the langpack. Removing all except one SearchEngine works and it (e.g. Bing) is used as default (as expected).

This seems intentional and expected.

2. Removing all default SearchEngines and adding a new one

Removing all SearchEngines and adding a new one shows the same behavior as above. All but one (Google for me) default SearchEngines are removed and the added one is second on the list.

I would expect all default SearchEngines to be removed if at least one SearchEngine is added.

3. Remove all SearchEngines and adding one while force_install langpack-de@firefox.mozilla.org

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked"
      },
      "langpack-de@firefox.mozilla.org": {
        "install_url": "https://releases.mozilla.org/pub/firefox/releases/78.9.0esr/linux-x86_64/xpi/de.xpi",
        "installation_mode": "force_installed"
      }
    },
    "SearchEngines": {
      "Add": [
        {
          "Name": "Qwant",
          "SuggestURLTemplate": "https://api.qwant.com/api/suggest/?q={searchTerms}",
          "URLTemplate": "https://www.qwant.com/?q={searchTerms}"
        }
      ],
      "Remove": [
        "Google",
        "Bing",
        "Amazon.de",
        "DuckDuckGo",
        "eBay",
        "Ecosia",
        "LEO Eng-Deu",
        "Wikipedia (de)"
      ]
    }
  }
}

Now it gets weird. Some SearchEngines are removed, some not. Double checked NAME_OF_SEARCH_ENGINE, nothing wrong here. about-pref about-support

I don't know what's going on. Maybe some default english SearchEngines are removed and after that the german langpack adds new ones?

4. Removing default SearchEngines via ExtensionSettings as in #484 and adding a new one

{
  "policies": {
    "ExtensionSettings": {
      "amazon@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "bing@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "ddg@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "ebay@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "ecosia@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "google@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "leo_ende_de@search.mozilla.org": {
        "installation_mode": "blocked"
      },
      "wikipedia@search.mozilla.org": {
        "installation_mode": "blocked"
      }
    },
    "SearchEngines": {
      "Add": [
        {
          "Name": "Qwant",
          "SuggestURLTemplate": "https://api.qwant.com/api/suggest/?q={searchTerms}",
          "URLTemplate": "https://www.qwant.com/?q={searchTerms}"
        }
      ],
      "Remove": [
        "Google",
        "Bing",
        "Amazon.de",
        "DuckDuckGo",
        "eBay",
        "Ecosia",
        "LEO Eng-Deu",
        "Wikipedia (de)"
      ]
    }
  }
}

This works! All default SearchEngines are removed and only the added one is in the list.

Note: They have to be both blocked via ExtensionSettings and removed via SearchEngines | Remove.

Conclusion

The behavior of removing and adding SearchEngines sometimes doesn't work as I would expect it. My use case is 2. Removing all default SearchEngines and adding a new one with the behavior of 4. Removing default SearchEngines via ExtensionSettings as in #484 and adding a new one.

l0b0 commented 5 months ago

Would it be possible to have this on mainline Firefox (that is, not ESR)? ESR (115.8.0esr, to be precise) seems to be broken for at least two major sites (Kagi and element.io).

mkaply commented 5 months ago

Would it be possible to have this on mainline Firefox (that is, not ESR)? ESR (115.8.0esr, to be precise) seems to be broken for at least two major sites (Kagi and element.io).

We don't currently have plans to put this on rapid release.

Are you just trying to remove engines?

What is broken about those sites?

l0b0 commented 5 months ago

Would it be possible to have this on mainline Firefox (that is, not ESR)? ESR (115.8.0esr, to be precise) seems to be broken for at least two major sites (Kagi and element.io).

We don't currently have plans to put this on rapid release.

Do changes like this eventually end up on the rapid release, or does that mean this functionality won't be on the rapid release for the foreseeable future?

Are you just trying to remove engines?

I'm trying to use a completely different set from the one Firefox comes with. I only ever use Kagi, so I want to remove the defaults, set up Kagi, and configure it as the default.

What is broken about those sites?

It's weird - only the top part of the page shows up at all. It's as if the search results have been blanked out by something. I don't see any errors in the network console, but maybe ESR has stricter origin rules or something?

mkaply commented 5 months ago

Do changes like this eventually end up on the rapid release, or does that mean this functionality won't be on the rapid release for the foreseeable future?

Yeah, we have no plans to put this on rapid release. Our concern is that search hijackers would use enterprise policy to change the engine.

Other browser providers have worked around this by requiring you to be connected to an MDM service (Azure, etc) in order to use the policy.

It's weird - only the top part of the page shows up at all. It's as if the search results have been blanked out by something. I don't see any errors in the network console, but maybe ESR has stricter origin rules or something?

We definitely don't have anything in the ESR around that. Could you point me to an exact page that doesn't work?

l0b0 commented 5 months ago

Do changes like this eventually end up on the rapid release, or does that mean this functionality won't be on the rapid release for the foreseeable future?

Yeah, we have no plans to put this on rapid release. Our concern is that search hijackers would use enterprise policy to change the engine.

I thought one of the main points of having an enterprise policy was that browsers could not easily override them. There's even SearchEngines.PreventInstalls to make sure additional search engines can't be installed.

Other browser providers have worked around this by requiring you to be connected to an MDM service (Azure, etc) in order to use the policy.

That won't be applicable in this case - I'm using it for my own devices.

It's weird - only the top part of the page shows up at all. It's as if the search results have been blanked out by something. I don't see any errors in the network console, but maybe ESR has stricter origin rules or something?

We definitely don't have anything in the ESR around that. Could you point me to an exact page that doesn't work?

You'll need a Kagi account, then go to any search page. On that page I see only the top beige bar, down to the menu starting with "Web", but the search result pane is just empty.

mkaply commented 5 months ago

You'll need a Kagi account, then go to any search page. On that page I see only the top beige bar, down to the menu starting with "Web", but the search result pane is just empty.

It's working for me on the ESR. I wonder if something else is blocking it? Can you try a new profile?

D3V1LC0D3R commented 2 months ago

If the user is compromised, what good will "protecting" the default search engines be? And what if you want to prevent those searches showing up for child protection? Couldnt you solve this by requiring the policies.json owned by root?

D3V1LC0D3R commented 2 months ago

Ok, i found a solution: in nixos home-manager you can set the metadata to hidden (however you cant uninstall it it seems)