Firefox add-ons catalog bans code obfuscation

Mozilla Company warned about tightening the rules of the Firefox add-ons directory (Mozilla AMO) to prevent the placement of malicious add-ons. Starting June 10th, add-ons that use code obfuscation methods, such as wrapping code in Base64 blocks, will be prohibited from being placed in the catalog.

At the same time, code minimization techniques (reducing the names of variables and functions, merging JavaScript files, removing extra spaces, comments, newlines and separators) remain allowed, but if, in addition to the minimized version, a full-fledged source code is attached to the add-on. Developers using code obfuscation or minification techniques are encouraged to publish a new version that complies with the code by June 10th. updated rules AMO and includes full source code for all components.

After June 10, problematic additions will be locked in the directory, and already installed instances via blacklist propagation will be disabled on users' systems. In addition, the practice of blocking add-ons that contain critical vulnerabilities, violate confidentiality and perform actions without the consent or control of the user will continue.

Recall that from January 1, 2019 in the Chrome Web Store catalog started acting a similar prohibition against obfuscating addon code. According to Google statistics, more than 70% of malicious and abusive add-ons blocked in the Chrome Web Store included unreadable code. Obfuscated code greatly complicates the review process, negatively impacts performance, and increases memory consumption.

Source: opennet.ru

Add a comment