Skip to content

Commit

Permalink
fix: flaws acrross learn, mozilla, api (#2818)
Browse files Browse the repository at this point in the history
  • Loading branch information
nschonni authored Mar 3, 2021
1 parent 81e70a5 commit 9733300
Show file tree
Hide file tree
Showing 64 changed files with 109 additions and 119 deletions.
2 changes: 1 addition & 1 deletion files/en-us/learn/accessibility/html/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -348,7 +348,7 @@ <h4 id="building_keyboard_accessibility_back_in">Building keyboard accessibility
}
};</pre>

<p>Here we add a listener to the <code>document</code> object to detect when a button has been pressed on the keyboard. We check what button was pressed via the event object's <code><a href="/en-US/docs/Web/API/KeyboardEvent/keyCode">keyCode</a></code> property; if it is the keycode that matches Return/Enter, we run the function stored in the button's <code>onclick</code> handler using <code>document.activeElement.click()</code>. <code><a href="/en-US/docs/Web/API/DocumentOrShadowRoot/activeElement">activeElement</a></code> which gives us the element that is currently focused on the page.</p>
<p>Here we add a listener to the <code>document</code> object to detect when a button has been pressed on the keyboard. We check what button was pressed via the event object's <code><a href="/en-US/docs/Web/API/KeyboardEvent/keyCode">keyCode</a></code> property; if it is the keycode that matches Return/Enter, we run the function stored in the button's <code>onclick</code> handler using <code>document.activeElement.click()</code>. <code><a href="/en-US/docs/Web/API/Document/activeElement">activeElement</a></code> which gives us the element that is currently focused on the page.</p>

<p>This is a lot of extra hassle to build the functionality back in. And there's bound to be other problems with it. <strong>Better to just use the right element for the right job in the first place.</strong></p>

Expand Down
2 changes: 1 addition & 1 deletion files/en-us/learn/css/howto/css_faq/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ <h2 id="Restoring_the_default_property_value">How do I restore the default value
h1 { color: red; }
h1 { color: black; }</pre>

<p>This has changed with CSS 2; the keyword <a href="/es/CSS/initial">initial</a> is now a valid value for a CSS property. It resets it to its default value, which is defined in the CSS specification of the given property.</p>
<p>This has changed with CSS 2; the keyword <a href="/en-US/docs/Web/CSS/initial">initial</a> is now a valid value for a CSS property. It resets it to its default value, which is defined in the CSS specification of the given property.</p>

<pre class="brush: css">/* Heading default color is black */
h1 { color: red; }
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@ <h4 id="Building_in_keyboard_accessibility">Building in keyboard accessibility</
document.activeElement.onclick(e);
}
};</pre>
Here we add a listener to the <code>document</code> object to detect when a button has been pressed on the keyboard. We check what button was pressed via the event object's <a href="/en-US/docs/Web/API/KeyboardEvent/keyCode">keyCode</a> property; if it is the keycode that matches Return/Enter, we run the function stored in the button's <code>onclick</code> handler using <code>document.activeElement.onclick()</code>. <code><a href="/en-US/docs/Web/API/DocumentOrShadowRoot/activeElement">activeElement</a></code> gives us the element that is currently focused on the page.</li>
Here we add a listener to the <code>document</code> object to detect when a button has been pressed on the keyboard. We check what button was pressed via the event object's <a href="/en-US/docs/Web/API/KeyboardEvent/keyCode">keyCode</a> property; if it is the keycode that matches Return/Enter, we run the function stored in the button's <code>onclick</code> handler using <code>document.activeElement.onclick()</code>. <code><a href="/en-US/docs/Web/API/Document/activeElement">activeElement</a></code> gives us the element that is currently focused on the page.</li>
</ol>

<div class="note">
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ <h2 id="Type">Type</h2>

<dl class="reference-values">
<dt><code>hostContains</code>{{optional_inline}}</dt>
<dd><code>string</code>. Matches if the <a href="/en-US/docs/Web/API/HTMLHyperlinkElementUtils/hostname">hostname</a> of the URL (without protocol or port – see <code>schemes</code> and <code>ports</code>) contains the given string.
<dd><code>string</code>. Matches if the <a href="/en-US/docs/Web/API/HTMLAnchorElement/hostname">hostname</a> of the URL (without protocol or port – see <code>schemes</code> and <code>ports</code>) contains the given string.
<ul>
<li>To test whether a hostname component starts with "foo", use <code>".foo"</code>. This matches "www.foobar.com" and "foo.com", because an implicit dot is added at the beginning of the hostname.</li>
<li>To test whether a hostname component ends with "foo", use <code>"foo."</code>.</li>
Expand Down
2 changes: 1 addition & 1 deletion files/en-us/mozilla/add-ons/webextensions/tips/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

<h2 id="Using_advanced_JavaScript_features_from_ECMAScript_2015_and_2016">Using advanced JavaScript features from ECMAScript 2015 and 2016</h2>

<p>Firefox <a href="/Web/JavaScript/New_in_JavaScript/ECMAScript_6_support_in_Mozilla">supports many features of ECMAScript 2015</a> out of the box. Several new and experimental features, however, are not available to the Web or WebExtensions by default. If you want to use these features, it's best to transpile your code using a tool such as <a href="https://babeljs.io/">Babel</a>.</p>
<p>Firefox <a href="/en-US/docs/Web/JavaScript/New_in_JavaScript/ECMAScript_6_support_in_Mozilla">supports many features of ECMAScript 2015</a> out of the box. Several new and experimental features, however, are not available to the Web or WebExtensions by default. If you want to use these features, it's best to transpile your code using a tool such as <a href="https://babeljs.io/">Babel</a>.</p>

<p>Beware that anything below this line is outdated information and has been removed from Babel 6.</p>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@
- Developing Mozilla
- NeedsTechnicalReview
---
<p>{{ gecko_minversion_header("9.0") }}</p>

<p>Starting with Gecko 9.0 {{ geckoRelease("9.0") }}, you can easily add new APIs to the {{ domxref("window.navigator") }} object by using the Category Manager. Add an entry to the "JavaScript-navigator-property" category.</p>

<p>The object must be implemented as an XPCOM component. Each method below of adding new objects to the navigator object requires that the new object is a registered XPCOM component. You can read about <a href="/en-US/docs/Mozilla/Add-ons/Code_snippets/JS_XPCOM#implementing_xpcom_components_in_javascript">creating and registering XPCOM components in JavaScript</a>.</p>
Expand Down
2 changes: 1 addition & 1 deletion files/en-us/mozilla/developer_guide/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ <h2 class="Documentation" id="Documentation_topics">Documentation topics</h2>
<dd>Information about the workings of the Mozilla platform.</dd>
<dt><a href="/en-US/docs/Mozilla">Mozilla</a></dt>
<dd>Much more additional information about Mozilla coding practices.</dd>
<dt><a href="/en-US/docs/Mozilla/Developer_guide/Adding_APIs_to_the_navigator_object">Adding APIs to the navigator object</a> {{ gecko_minversion_inline("9.0") }}</dt>
<dt><a href="/en-US/docs/Mozilla/Developer_guide/Adding_APIs_to_the_navigator_object">Adding APIs to the navigator object</a> </dt>
<dd>How to augment the {{ domxref("window.navigator") }} object with additional APIs.</dd>
<dt><a href="/en-US/docs/Mozilla/Developer_guide/Interface_Compatibility">Interface Compatibility</a></dt>
<dd>Guidelines for modifying scriptable and binary APIs in Mozilla.</dd>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
title: Listening to events on all tabs
slug: Mozilla/Developer_guide/Listening_to_events_on_all_tabs
---
<p>{{ fx_minversion_header("3.5") }}</p>
<p>Firefox 3.5 adds support for listening to progress events on all tabs.</p>
<h2 id="Adding_a_listener">Adding a listener</h2>
<p>To listen to progress events on all tabs, call the browser's <a href="/en-US/docs/XUL/Method/addTabsProgressListener"><code>addTabsProgressListener()</code></a> method:</p>
Expand Down
2 changes: 1 addition & 1 deletion files/en-us/mozilla/firefox/privacy/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,5 @@ <h2 id="See_also">See also</h2>

<ul>
<li><a href="https://support.mozilla.org/en-US/products/firefox/privacy-and-security">Privacy and security settings</a></li>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/Security">Web Security</a></li>
<li><a href="/en-US/docs/Web/Security">Web Security</a></li>
</ul>
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ <h3 id="What_origins_are_cleared">What origins are cleared?</h3>

<ol>
<li>It has stored cookies or accessed other site storage (e.g. <a href="/en-US/docs/Web/API/Web_Storage_API">localStorage</a>, <a href="/en-US/docs/Web/API/IndexedDB_API">IndexedDB</a>, or the <a href="/en-US/docs/Web/API/CacheStorage">Cache API</a>) within the last 72 hours. Since cookies are per-host, we will clear both the <code>http</code> and <code>https</code> origin variants of a cookie host.</li>
<li>The origin is <a href="/en-US/docs/Mozilla/Firefox/Privacy/Storage_access_policy#Tracking_protection_explained">classified as a tracker</a> in our Tracking Protection list.</li>
<li>The origin is <a href="/en-US/docs/Mozilla/Firefox/Privacy/Storage_access_policy#tracking_protection_explained">classified as a tracker</a> in our Tracking Protection list.</li>
<li>No origin with the same base domain (eTLD+1) has a user-interaction permission.
<ul>
<li>This permission is granted to an origin for 45 days once a user interacts with a top-level document from that origin. "Interacting" includes scrolling.</li>
Expand Down Expand Up @@ -61,7 +61,7 @@ <h3 id="What_data_is_cleared">What data is cleared?</h3>
<p><strong>Note</strong>: Even though we're clearing all of this data, we currently only flag origins for clearing when they use cookies or other site storage.</p>
</div>

<p>Storage clearing ignores origin attributes. This means that storage will be cleared across <a href="https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers">containers</a> and isolated storage (i.e. from <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/API/cookies#First-party_isolation">First-Party Isolation</a>).</p>
<p>Storage clearing ignores origin attributes. This means that storage will be cleared across <a href="https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers">containers</a> and isolated storage (i.e. from <a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/API/cookies#first-party_isolation">First-Party Isolation</a>).</p>

<h3 id="How_frequently_is_data_cleared">How frequently is data cleared?</h3>

Expand All @@ -80,7 +80,7 @@ <h2 id="Debugging">Debugging</h2>

<p>Different log levels can be set via the <code>privacy.purge_trackers.logging.level</code> pref.</p>

<p>For debugging purposes, it's easiest to trigger storage clearing by triggering the service directly via the <a href="/en-US/docs/Tools/Browser_Console#Browser_Console_command_line">Browser Console command line</a>. Note that this is different from the normal <a href="/en-US/docs/Tools/Web_Console">Web Console</a> you might use to debug a website, and requires the <code>devtools.chrome.enabled</code> pref to be set to <code>true</code> to use it interactively. Once you've enabled the Browser Console you can trigger storage clearing by running the following command:</p>
<p>For debugging purposes, it's easiest to trigger storage clearing by triggering the service directly via the <a href="/en-US/docs/Tools/Browser_Console#browser_console_command_line">Browser Console command line</a>. Note that this is different from the normal <a href="/en-US/docs/Tools/Web_Console">Web Console</a> you might use to debug a website, and requires the <code>devtools.chrome.enabled</code> pref to be set to <code>true</code> to use it interactively. Once you've enabled the Browser Console you can trigger storage clearing by running the following command:</p>

<pre class="brush: js">await Components.classes["@mozilla.org/purge-tracker-service;1"].getService(Components.interfaces.nsIPurgeTrackerService).purgeTrackingCookieJars()</pre>

Expand All @@ -91,7 +91,7 @@ <h2 id="Other_implementations">Other implementations</h2>
<p>WebKit first shipped redirect tracking protection in <a href="https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/">ITP 2.0</a> (they refer to the same attack as bounce tracking). As of July 2020, there are several significant differences between WebKit’s implementation and Firefox’s implementation:</p>

<ul>
<li>The list of origins to be cleared in Firefox is based on our <a href="/en-US/docs/Mozilla/Firefox/Privacy/Storage_access_policy#Tracking_protection_explained">tracking protection list</a>; WebKit relies on ITP's classification.</li>
<li>The list of origins to be cleared in Firefox is based on our <a href="/en-US/docs/Mozilla/Firefox/Privacy/Storage_access_policy#tracking_protection_explained">tracking protection list</a>; WebKit relies on ITP's classification.</li>
<li>Firefox's definition of "interaction" includes user scrolling when visiting the origin as a first party; WebKit’s does not.</li>
<li>Firefox will not clear data for an origin if it has received interaction as a first party in the last 45 days of calendar time; WebKit’s interaction window is 30 days of browser use (e.g. days in which the user has had at least one interaction with Safari).</li>
</ul>
Original file line number Diff line number Diff line change
Expand Up @@ -33,5 +33,5 @@ <h2 id="See_also">See also</h2>

<ul>
<li><a href="https://support.mozilla.org/en-US/kb/content-blocking">Content blocking</a> on <a href="https://support.mozilla.org">support.mozilla.org</a></li>
<li><a href="/en-US/docs/Web/HTML/CORS_settings_attributes">The <code>crossorigin</code> attribute</a></li>
<li><a href="/en-US/docs/Web/HTML/Attributes/crossorigin">The <code>crossorigin</code> attribute</a></li>
</ul>
Original file line number Diff line number Diff line change
Expand Up @@ -34,5 +34,5 @@ <h2 id="See_also">See also</h2>

<ul>
<li><a href="https://support.mozilla.org/en-US/kb/content-blocking">Content blocking</a> on <a href="https://support.mozilla.org">support.mozilla.org</a></li>
<li><a href="/en-US/docs/Web/HTML/CORS_settings_attributes">The <code>crossorigin</code> attribute</a></li>
<li><a href="/en-US/docs/Web/HTML/Attributes/crossorigin">The <code>crossorigin</code> attribute</a></li>
</ul>
Original file line number Diff line number Diff line change
Expand Up @@ -39,5 +39,5 @@ <h2 id="See_also">See also</h2>

<ul>
<li><a href="https://support.mozilla.org/en-US/kb/content-blocking">Content blocking</a> on <a href="https://support.mozilla.org">support.mozilla.org</a></li>
<li><a href="/en-US/docs/Web/HTML/CORS_settings_attributes">The <code>crossorigin</code> attribute</a></li>
<li><a href="/en-US/docs/Web/HTML/Attributes/crossorigin">The <code>crossorigin</code> attribute</a></li>
</ul>
Original file line number Diff line number Diff line change
Expand Up @@ -108,14 +108,14 @@ <h2 id="What_does_the_storage_access_policy_block">What does the storage access
<p>Browser caches:</p>

<ul>
<li>The <a href="/en-US/docs/Web/HTTP/Caching">HTTP cache</a>, the Image cache, and the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Alt-Svc">Alternative Services (Alt-Svc) cache</a> are all partitioned for tracking resources, such that each top-level origin will have a separate partition and tracking resources on different top-level origins will be cached separate from each other.</li>
<li>The <a href="/en-US/docs/Web/HTTP/Caching">HTTP cache</a>, the Image cache, and the <a href="/en-US/docs/Web/HTTP/Headers/Alt-Svc">Alternative Services (Alt-Svc) cache</a> are all partitioned for tracking resources, such that each top-level origin will have a separate partition and tracking resources on different top-level origins will be cached separate from each other.</li>
</ul>

<p>Network connections:</p>

<ul>
<li><a href="https://wiki.mozilla.org/Security/Server_Side_TLS#Session_Resumption">TLS sessions</a> will not be resumed using a session ticket when an HTTPS connection is made to an embedded third-party resource that is classified as a tracker.</li>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Connection_management_in_HTTP_1.x#Persistent_connections">HTTP connection reuse</a> by domains classified as trackers is limited to requests that occur under the same top-level origin. For example, a request for content from tracker.example on news.example will not reuse an HTTP connection with a request for content from tracker.example on shopping.example or with requests that occur when tracker.example is visited directly (i.e., as a first party).</li>
<li><a href="/en-US/docs/Web/HTTP/Connection_management_in_HTTP_1.x#persistent_connections">HTTP connection reuse</a> by domains classified as trackers is limited to requests that occur under the same top-level origin. For example, a request for content from tracker.example on news.example will not reuse an HTTP connection with a request for content from tracker.example on shopping.example or with requests that occur when tracker.example is visited directly (i.e., as a first party).</li>
</ul>

<p>HTTP Referrers</p>
Expand All @@ -136,7 +136,7 @@ <h3 id="What_is_not_blocked_by_the_policy">What is not blocked by the policy?</h

<h2 id="Storage_access_grants">Storage access grants</h2>

<p>In order to improve web compatibility and permit third-party integrations that require storage access, Firefox will grant storage access scoped to the first party for a particular third-party origin as described in this section. Currently, Firefox includes some web compatibility heuristics that grant storage access to third-party resources classified as trackers when a user interacts with those third parties. We do this when we expect that not granting access would cause the web page to break. We also support an initial implementation of the <a href="https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API">Storage Access API</a>, through which embedded {{htmlelement("iframe")}}s can request storage access by calling {{domxref("Document.requestStorageAccess()")}}. Although both of these approaches provide the same level of storage access, we recommend third parties switch to using the Storage Access API in order to guarantee their access to storage.</p>
<p>In order to improve web compatibility and permit third-party integrations that require storage access, Firefox will grant storage access scoped to the first party for a particular third-party origin as described in this section. Currently, Firefox includes some web compatibility heuristics that grant storage access to third-party resources classified as trackers when a user interacts with those third parties. We do this when we expect that not granting access would cause the web page to break. We also support an initial implementation of the <a href="/en-US/docs/Web/API/Storage_Access_API">Storage Access API</a>, through which embedded {{htmlelement("iframe")}}s can request storage access by calling {{domxref("Document.requestStorageAccess()")}}. Although both of these approaches provide the same level of storage access, we recommend third parties switch to using the Storage Access API in order to guarantee their access to storage.</p>

<h3 id="Automatic_storage_access_upon_interaction">Automatic storage access upon interaction</h3>

Expand Down Expand Up @@ -210,7 +210,7 @@ <h3 id="Developer_Tools_notifications">Developer Tools notifications</h3>

<p>The <a href="/en-US/docs/Tools/Network_Monitor">Network Monitor</a> in Firefox Developer Tools now includes an indicator for all resource requests that have been classified as tracking resources. This indicator is shown as a shield icon in the domain column. In the sample image below, <code>trackertest.org</code> is classified as a tracking resource, while the request to example.com is not.</p>

<p><img alt="network requests in Firefox devtools indicating which ones are tracking resources with a small shield icon" src="https://mdn.mozillademos.org/files/16181/Screen_Shot_2018-09-21_at_10.34.22_AM.png" style="border-style: solid; border-width: 1px; display: block; height: 57px; margin: 0px auto; width: 600px;"></p>
<p><img alt="network requests in Firefox devtools indicating which ones are tracking resources with a small shield icon" src="screen_shot_2018-09-21_at_10.34.22_am.png" style="border-style: solid; border-width: 1px; display: block; margin: 0px auto;"></p>

<h3 id="Adding_custom_domains_to_the_Tracking_Protection_list">Adding custom domains to the Tracking Protection list</h3>

Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading

0 comments on commit 9733300

Please sign in to comment.