Closed Bug 1808328 Opened 2 years ago Closed 2 years ago

The dynamic blocklist is applied even if the third party module blocking was disabled via the DisableThirdPartyModuleBlocking policy

Categories

(Firefox :: Enterprise Policies, defect)

Firefox 110
All
Windows
defect

Tracking

()

RESOLVED WONTFIX
Tracking Status
firefox-esr102 --- unaffected
firefox108 --- unaffected
firefox109 --- unaffected
firefox110 --- affected

People

(Reporter: emilghitta, Assigned: gstoll)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached image policyBlocked.gif

Found in

  • Firefox 110.0a1 (Build Id: 20230102165835)

Affected versions

  • Firefox 110.0a1 (Build Id: 20230102165835)

Tested platforms

  • Affected platforms: Windows 10 64bit

Preconditions

  1. Have Google Drive for desktop installed (https://www.google.com/drive/download/)
  2. Launch Firefox.
  3. Block the drivefsext.dll via the about:third-party page.
  4. Restart Firefox.

Steps to reproduce

  1. Disable the user-driven DLL blocking by using the following policy inside the policies.json file:
    { "policies": { "DisableThirdPartyModuleBlocking": true } }
  2. Restart Firefox.
  3. Press ALT + F and select "Open File".
  4. Access the about:third-party page and inspect the drivefsext.dll.

Expected result

  • Step 3: The Google Drive entries have a little cloud overlay displayed.
  • Step 4: The drivefsext.dll has the status of Loaded.

Actual result

  • Step 3: No cloud overlay is displayed for the Google Drive entries.
  • Step 4: The drivefsext.dll has the status of Blocked.

Regression range

  • This is not a regression.
Assignee: nobody → gstoll
Status: NEW → ASSIGNED

The problem is that InitializeDllBlocklistOOPFromLauncher() calls PolicyCheckBoolean(L"DisableThirdPartyModuleBlocking") to see if the blocklist is disabled, but that just checks the registry key. (the about:third-party page itself does seem to work correctly) I'm not sure if we should be reading the JSON file to look for this specifically...

So this is going to be a limitation.

You can only turn off the blocklist via GPO, not policies.json. This is similar to a few other Windows specific policies.

Sorry, I should have caught that when this report was opened.

Thanks for the info! I was not aware of that :D.

I'm going to update our tests & will apply this policy directly via regedit or GPO instead.

My guess is that we can mark this ticket as wontfix then?

Thanks for the info! I was not aware of that :D.

I should have caught that.

My guess is that we can mark this ticket as wontfix then?

yep

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: